chore(deps): raise stale transitive dependency floors

[nicktrn]

Summary

A number of pnpm.overrides entries had drifted behind the releases they were written against. An override fixes the resolved version outright, so in every one of these cases the tree was pinned to the floor value rather than picking up later releases in the same line. This raises each floor to a current release, and widens the selectors that were scoped to an exact upper bound so they keep matching.

Override	Before	After
body-parser (under express@^4)	1.20.3	^1.20.6
tar	7.5.19	7.5.21
hono	4.12.25	4.12.34
undici (6.x)	6.27.0	6.28.0
undici (7.x)	7.28.0	7.29.0
js-yaml (3.x)	3.14.2	3.15.1
js-yaml (4.x)	4.1.1	4.3.1
dompurify	^3.4.1	^3.4.13
vite	^6.4.2	^6.4.3
protobufjs	^7.5.6	^7.6.5
socket.io-parser	^4.2.6	^4.2.7
postcss	^8.5.10	^8.5.23
fast-uri	^3.1.2	^3.1.5
brace-expansion (1.x)	1.1.13	1.1.18
brace-expansion (2.x)	2.0.3	2.1.4
brace-expansion (5.x)	5.0.6	5.0.9
ip-address (under @jsonhero/json-infer-types)	^10.2.0	^10.3.1

Every parent's declared range still accepts the new resolution, so nothing is forced outside its stated bounds by this change.

Two of these changed a default rather than just moving version. js-yaml 4.2.0 stopped resolving underscore-separated scalars such as 1_000 as numbers, which is the YAML 1.2 behaviour, and there are none in any YAML in this repo. brace-expansion 2.1.x now caps expansion size by default, well above anything a real glob produces, and minimatch calls it with no options. Neither is reachable from how we use them.

undici@5.29.0 and vite@4.4.9 are left alone: their parents cap below the newer lines, so moving either would mean taking the parent across a major.

Verified with a clean install, and pnpm run typecheck passes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1c390a1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ecbb1f99-36b7-43c5-854b-0f17ebf6631b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Updated pnpm dependency overrides in package.json for body-parser, tar, hono, undici, js-yaml, dompurify, vite, protobufjs, socket.io-parser, postcss, fast-uri, brace-expansion, and ip-address.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the dependency override updates.
Description check	✅ Passed	The description clearly explains the dependency changes and records clean-install and typecheck validation, but omits the template checklist and issue reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-transitive-dep-floors

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@1c390a1

trigger.dev

npm i https://pkg.pr.new/trigger.dev@1c390a1

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@1c390a1

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@1c390a1

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@1c390a1

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@1c390a1

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@1c390a1

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@1c390a1

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@1c390a1

commit: 1c390a1

[devin-ai-integration]

Devin Review found 1 new potential issue.