nic-6443 opened a new pull request, #14198: URL: https://github.com/apache/apisix/pull/14198
### Description This refreshes four dev dependencies of the test suite in `t/pnpm-lock.yaml` to versions that are no longer affected by published advisories: - body-parser 2.3.0 -> 2.4.0 (GHSA-27r3-jxmh-p828), via express 5.3.0's `^2.3.0` - lodash 4.17.21 -> 4.18.1 (GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg), via `@trivago/prettier-plugin-sort-imports`'s `^4.17.21` - yaml 2.7.1 -> 2.9.1 (GHSA-48c2-rrv3-qjmp), our own `^2.7.1` plus docker-compose and vite - zod 3.25.76 -> 4.6.7 (GHSA-mrhx-c7xc-m3w5), via `@modelcontextprotocol/sdk` and `zod-to-json-schema` Every new version is inside the range the parent package already declares, so `package.json` is untouched and no `pnpm.overrides` entry is added. zod is the only major jump: there is no patched 3.x, but both of its dependents declare `^3.25 || ^4` and the test code never imports zod directly; it only reaches it through the MCP SDK client in `t/plugin/openapi-to-mcp-interop.spec.ts`, which `t/plugin/openapi-to-mcp-interop.t` drives against the plugin over both transports. The lockfile was regenerated with the pnpm version pinned in `packageManager` (10.14.0), and the diff is limited to these four packages and the peer suffixes that reference them. `pnpm install --frozen-lockfile` passes in `t/`. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [ ] I have added tests corresponding to this change (dependency-only change; covered by the existing TS specs driven from `.t` files) - [ ] I have updated the documentation to reflect this change (no user-facing change) - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
