Fix dependency security vulnerabilities

[mpsq]

Summary

• Refresh pnpm-lock.yaml so @graphql-codegen/cli resolves shell-quote to fixed version 1.8.4
• Add a pnpm override for ws@8.21.0 so exact transitive GraphQL Tools pins no longer install vulnerable ws@8.13.0
• Upgrade direct rollup dev dependency to patched 3.30.0, keeping the existing Rollup major while removing vulnerable 3.29.5
• Add a pnpm override for immutable@3.8.3 so @ardatan/relay-compiler no longer installs vulnerable immutable@3.7.6
• Add a pnpm override for lodash@4.18.1 so GraphQL Codegen and schema tooling no longer install vulnerable lodash@4.17.21
• Add a pnpm override for tmp@0.2.7 so external-editor consumers no longer install vulnerable tmp@0.0.33
• Refresh pnpm-lock.yaml so runtime ajv resolves fast-uri to patched 3.1.2
• Leave GraphQL Codegen package versions unchanged because the existing stack can resolve to patched transitive packages with the overrides

Validation

• pnpm install --frozen-lockfile
• pnpm test -- --run
• pnpm why shell-quote confirms only shell-quote@1.8.4 is installed
• pnpm why ws confirms only ws@8.21.0 is installed
• pnpm why rollup confirms direct/plugin Rollup consumers resolve to rollup@3.30.0
• pnpm why immutable confirms only immutable@3.8.3 is installed
• pnpm why lodash confirms only lodash@4.18.1 is installed
• pnpm why tmp confirms only tmp@0.2.7 is installed
• pnpm why fast-uri confirms only fast-uri@3.1.2 is installed
• pnpm build
• pnpm codegen completed; unrelated generated schema output from the external schema was not included

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rollup@​3.30.0

View full report