pnpm-lock.yaml

@@ -4,6 +4,10 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  form-data: '>=4.0.6'
+  uuid: '>=11.1.1'
+
 importers:
 
   .:
@@ -1161,10 +1165,6 @@ packages:
       debug:
         optional: true
 
-  form-data@4.0.4:
-    resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==}
-    engines: {node: '>= 6'}
-
   form-data@4.0.6:
     resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
@@ -1793,9 +1793,8 @@ packages:
   util@0.10.4:
     resolution: {integrity: sha512-0Pm9hTQ3se5ll1XihRic3FDIku70C+iHUdT/W926rSgHV5QgXsYbKZN8MSC3tJtSkhuROzvsQjAaFENRXr+19A==}
 
-  uuid@10.0.0:
-    resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==}
-    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
+  uuid@14.0.1:
+    resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==}
     hasBin: true
 
   webidl-conversions@3.0.1:
@@ -2710,7 +2709,7 @@ snapshots:
       csv-parse: 5.6.0
       debug: 4.4.3
       decomment: 0.9.5
-      form-data: 4.0.4
+      form-data: 4.0.6
       fs-extra: 10.1.0
       http-proxy-agent: 7.0.2
       https-proxy-agent: 7.0.6
@@ -2773,7 +2772,7 @@ snapshots:
       path: 0.12.7
       quickjs-emscripten: 0.32.0
       tv4: 1.3.0
-      uuid: 10.0.0
+      uuid: 14.0.1
       xml-formatter: 3.7.0
       xml2js: 0.6.2
       yaml: 2.9.0
@@ -3205,14 +3204,6 @@ snapshots:
     optionalDependencies:
       debug: 4.4.3
 
-  form-data@4.0.4:
-    dependencies:
-      asynckit: 0.4.0
-      combined-stream: 1.0.8
-      es-set-tostringtag: 2.1.0
-      hasown: 2.0.4
-      mime-types: 2.1.35
-
   form-data@4.0.6:
     dependencies:
       asynckit: 0.4.0
@@ -3836,7 +3827,7 @@ snapshots:
     dependencies:
       inherits: 2.0.3
 
-  uuid@10.0.0: {}
+  uuid@14.0.1: {}
 
   webidl-conversions@3.0.1: {}
 

pnpm-workspace.yaml

@@ -9,3 +9,14 @@ allowBuilds:
   protobufjs: true
   sharp: true
   workerd: true
+
+# Force patched versions of vulnerable transitive dev-tooling deps (see #36).
+# form-data <4.0.6 has a HIGH CRLF-injection advisory; uuid <11.1.1 has a MEDIUM
+# buffer-bounds advisory. Both are pulled in transitively by wrangler /
+# @usebruno/cli and are dev-only (not in the Go/Wasm Worker). pnpm 11 no longer
+# reads the "pnpm" field in package.json, so overrides live here alongside the
+# build-approval config. Values are quoted because a leading ">" is a YAML
+# block-scalar indicator.
+overrides:
+  form-data: '>=4.0.6'
+  uuid: '>=11.1.1'