From 1a7cd7039c0968e27c5fa13c559e11d629739e66 Mon Sep 17 00:00:00 2001 From: Benoit Travers Date: Thu, 13 Aug 2026 20:32:38 +0200 Subject: [PATCH 1/2] chore: update repo references after config -> tools rename Closes #1: the rename frees @btravstack/config for the planned 12-factor env module. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci-reusable.yml | 2 +- .github/workflows/release-reusable.yml | 2 +- README.md | 6 +++--- package.json | 4 ++-- packages/commitlint/package.json | 6 +++--- packages/lefthook/package.json | 6 +++--- packages/oxfmt/package.json | 6 +++--- packages/oxlint/package.json | 6 +++--- packages/tsconfig/package.json | 6 +++--- packages/typedoc/package.json | 6 +++--- 10 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci-reusable.yml b/.github/workflows/ci-reusable.yml index e371dae..7caa2f6 100644 --- a/.github/workflows/ci-reusable.yml +++ b/.github/workflows/ci-reusable.yml @@ -7,7 +7,7 @@ # pull_request: { branches: [main] } # jobs: # ci: -# uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 +# uses: btravstack/tools/.github/workflows/ci-reusable.yml@workflows-v1 # with: # changeset: true # contract repos that enforce changesets # integration-tests: true # run the integration suite diff --git a/.github/workflows/release-reusable.yml b/.github/workflows/release-reusable.yml index ff9f75c..9dfada8 100644 --- a/.github/workflows/release-reusable.yml +++ b/.github/workflows/release-reusable.yml @@ -10,7 +10,7 @@ # jobs: # release: # if: ${{ github.event.workflow_run.conclusion == 'success' }} -# uses: btravstack/config/.github/workflows/release-reusable.yml@main +# uses: btravstack/tools/.github/workflows/release-reusable.yml@main # secrets: # RELEASE_PAT: ${{ secrets.RELEASE_PAT }} # diff --git a/README.md b/README.md index 8c586be..b5d0dc0 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# @btravstack/config +# @btravstack/tools Shared configuration packages for [btravstack](https://github.com/btravstack) repositories. Each repo used to hand-copy a near-identical `tools/tsconfig`, @@ -102,7 +102,7 @@ on: pull_request: { branches: [main] } jobs: ci: - uses: btravstack/config/.github/workflows/ci-reusable.yml@main + uses: btravstack/tools/.github/workflows/ci-reusable.yml@main with: changeset: true # contract repos that enforce changesets ``` @@ -115,7 +115,7 @@ on: jobs: release: if: ${{ github.event.workflow_run.conclusion == 'success' }} - uses: btravstack/config/.github/workflows/release-reusable.yml@main + uses: btravstack/tools/.github/workflows/release-reusable.yml@main secrets: RELEASE_PAT: ${{ secrets.RELEASE_PAT }} ``` diff --git a/package.json b/package.json index 8ebc431..b5b55ae 100644 --- a/package.json +++ b/package.json @@ -1,12 +1,12 @@ { - "name": "@btravstack/config-root", + "name": "@btravstack/tools-root", "private": true, "description": "Shared configuration packages for btravstack repositories", "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git" + "url": "https://github.com/btravstack/tools.git" }, "type": "module", "scripts": { diff --git a/packages/commitlint/package.json b/packages/commitlint/package.json index d38728a..79d99e1 100644 --- a/packages/commitlint/package.json +++ b/packages/commitlint/package.json @@ -7,15 +7,15 @@ "config", "conventional-commits" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/commitlint#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/commitlint#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/commitlint" }, "files": [ diff --git a/packages/lefthook/package.json b/packages/lefthook/package.json index 281eae3..1433539 100644 --- a/packages/lefthook/package.json +++ b/packages/lefthook/package.json @@ -7,15 +7,15 @@ "git-hooks", "lefthook" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/lefthook#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/lefthook#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/lefthook" }, "files": [ diff --git a/packages/oxfmt/package.json b/packages/oxfmt/package.json index 08b7331..7cb7d96 100644 --- a/packages/oxfmt/package.json +++ b/packages/oxfmt/package.json @@ -7,15 +7,15 @@ "format", "oxfmt" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/oxfmt#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/oxfmt#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/oxfmt" }, "files": [ diff --git a/packages/oxlint/package.json b/packages/oxlint/package.json index 86a0cba..7074529 100644 --- a/packages/oxlint/package.json +++ b/packages/oxlint/package.json @@ -7,15 +7,15 @@ "lint", "oxlint" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/oxlint#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/oxlint#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/oxlint" }, "files": [ diff --git a/packages/tsconfig/package.json b/packages/tsconfig/package.json index 5c97f91..a5f0598 100644 --- a/packages/tsconfig/package.json +++ b/packages/tsconfig/package.json @@ -7,15 +7,15 @@ "tsconfig", "typescript" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/tsconfig#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/tsconfig#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/tsconfig" }, "files": [ diff --git a/packages/typedoc/package.json b/packages/typedoc/package.json index 5a8f99f..3936e3d 100644 --- a/packages/typedoc/package.json +++ b/packages/typedoc/package.json @@ -7,15 +7,15 @@ "markdown", "typedoc" ], - "homepage": "https://github.com/btravstack/config/tree/main/packages/typedoc#readme", + "homepage": "https://github.com/btravstack/tools/tree/main/packages/typedoc#readme", "bugs": { - "url": "https://github.com/btravstack/config/issues" + "url": "https://github.com/btravstack/tools/issues" }, "license": "MIT", "author": "Benoit TRAVERS ", "repository": { "type": "git", - "url": "https://github.com/btravstack/config.git", + "url": "https://github.com/btravstack/tools.git", "directory": "packages/typedoc" }, "files": [ From d7dc3cca6bfcf052269b6951f92e547cc4cd36d8 Mon Sep 17 00:00:00 2001 From: Benoit Travers Date: Thu, 13 Aug 2026 20:52:32 +0200 Subject: [PATCH 2/2] fix(deps): bump js-yaml and fast-uri past new audit advisories js-yaml 3.15.1 / 4.3.1 and fast-uri 3.1.5 (GHSA-7p8r-x3mc-p8w7, superseding the GHSA-v2hh-gcrm-f6hx pin). All patched versions are 13 days old, so the fast-uri minimumReleaseAgeExclude escape hatch is removed. Co-Authored-By: Claude Fable 5 --- pnpm-lock.yaml | 28 ++++++++++++++-------------- pnpm-workspace.yaml | 14 ++++---------- 2 files changed, 18 insertions(+), 24 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cb7ed42..00ab12c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -26,7 +26,7 @@ catalogs: version: 1.73.0 overrides: - fast-uri@<3.1.4: 3.1.4 + fast-uri@<3.1.5: 3.1.5 importers: @@ -639,8 +639,8 @@ packages: resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==} engines: {node: '>=8.6.0'} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -741,12 +741,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true json-parse-even-better-errors@2.3.1: @@ -1158,7 +1158,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@changesets/pre@2.0.2': dependencies: @@ -1472,7 +1472,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1535,7 +1535,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 parse-json: 5.2.0 cross-spawn@7.0.6: @@ -1581,7 +1581,7 @@ snapshots: merge2: 1.4.1 micromatch: 4.0.8 - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fastq@1.20.1: dependencies: @@ -1670,12 +1670,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.0: + js-yaml@3.15.1: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -1847,7 +1847,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.15.0 + js-yaml: 3.15.1 pify: 4.0.1 strip-bom: 3.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index de1531e..c932f56 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -20,18 +20,12 @@ allowBuilds: lefthook: true overrides: - # GHSA-v2hh-gcrm-f6hx (High): fast-uri host confusion via literal backslash - # authority delimiter. Only the vulnerable <3.1.4 line is present (transitive, - # via @commitlint/cli > ajv); 3.1.4 is the first patched release. Newly - # disclosed; dev-tooling only. fast-uri is in minimumReleaseAgeExclude below - # because 3.1.4 is younger than the 7-day cutoff. - "fast-uri@<3.1.4": "3.1.4" + # GHSA-7p8r-x3mc-p8w7 (High, supersedes GHSA-v2hh-gcrm-f6hx): fast-uri, + # patched in 3.1.5. Transitive only (via @commitlint/cli > ajv); dev-tooling + # only. 3.1.5 published 2026-07-31, past the 7-day cutoff. + "fast-uri@<3.1.5": "3.1.5" # Supply-chain maturity delay: mirror the consumer repos. Don't adopt a freshly # published version until it has been on the registry for 7 days (10080 minutes). minimumReleaseAge: 10080 minimumReleaseAgeStrict: true -minimumReleaseAgeExclude: - # Temporary: fast-uri 3.1.4 (the GHSA-v2hh-gcrm-f6hx override above) is younger - # than the 7-day cutoff. Remove once 3.1.4 is 7 days old (published 2026-07-19). - - fast-uri