braces 3.0.3, the latest upstream release, has an open advisory with no
fixed version (CVE-2026-93687: deeply nested patterns exhaust the stack
in its recursive AST walkers). @pezkuwi/braces is a fork that rejects
nesting deeper than maxDepth (500) with a SyntaxError; its tests include
the upstream suite.
The three open Dependabot alerts (http-cache-semantics, serialize-
javascript) matched versions the lockfile still held. `yarn up -R` moves
http-cache-semantics to a fixed version within range, and
terser-webpack-plugin 5.6 no longer depends on serialize-javascript.
- @pezkuwi/dev, dev-test, dev-ts ^0.86.2
- addrcheck.spec: optional call instead of a guard expression
(@typescript-eslint/prefer-optional-chain)
- checkRepoMeta: drop the initial value every path overwrites
(no-useless-assignment)
- ipfsUpload: drop a disable directive for a rule the toolchain no
longer reports
`yarn up -R` for every package with an open Dependabot alert, without
changing any declared range: tar, minimatch, brace-expansion, ip-address,
form-data, bn.js, fast-uri, js-yaml, lodash, postcss, rollup, ws and others.
Of the 117 open alerts, 14 still match a locked version afterwards. All of
them come from @pezkuwi/dev's toolchain (webpack-dev-server 4,
typescript-eslint 6, terser-webpack-plugin, express, sockjs, latest-version)
and need a major upgrade there; none is in the published @pezkuwi/phishing,
which depends only on @pezkuwi/util, util-crypto, x-fetch, tldts and tslib.
@pezkuwi/util, util-crypto and x-fetch now require ^14.0.26, which brings
@pezkuwi/wasm-crypto 7.5.20 in place of 7.5.17. The lockfile moves with it.
axios moves to ^1.20.0 in resolutions, with the lockfile entries that the
Dependabot PR for it (#11) left out; without them `yarn install --immutable`
refused to run and every check on that PR failed.
Lock Threads has failed on every scheduled run: lock-threads v4 rejects a
github-token longer than 100 characters, and GitHub's tokens now are. v6.0.2
fixes the validation. Since v5 the action also locks discussions by default;
process-only keeps it to issues and pull requests, as before and as the job's
permissions allow.
- Update phishing URL to phishing.pezkuwichain.io
- Update author to Dijital Kurdistan Tech Inst
- Update README with Pezkuwi project references
- Update IPFS reference to pezkuwichain.io
- Rebrand all package references from @polkadot to @pezkuwi
Satoshi Qazi Muhammed