From a544a8a11596b33e9341d92774c168513a1aa02d Mon Sep 17 00:00:00 2001 From: "socket-pr-bot[bot]" <294242679+socket-pr-bot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:32:51 +0000 Subject: [PATCH] chore(deps): promote soaked exclusions (2026-08-03) --- .config/fleet/pnpm-workspace.fleet.yaml | 2 +- package.json | 4 +- pnpm-lock.yaml | 114 ++++++++++++------------ pnpm-workspace.yaml | 24 ++--- 4 files changed, 72 insertions(+), 72 deletions(-) diff --git a/.config/fleet/pnpm-workspace.fleet.yaml b/.config/fleet/pnpm-workspace.fleet.yaml index 6adbad4b3..6fa2cefe1 100644 --- a/.config/fleet/pnpm-workspace.fleet.yaml +++ b/.config/fleet/pnpm-workspace.fleet.yaml @@ -53,7 +53,7 @@ catalog: # .claude/skills/fleet/property-and-fuzz-testing. 'fast-check': 4.9.0 'magic-string': 1.1.0 - 'markdownlint-cli2': 0.23.1 + 'markdownlint-cli2': 0.23.2 'mdast-util-from-markdown': 2.0.3 'micromark': 4.0.2 'neosanitize': 0.3.0 diff --git a/package.json b/package.json index a072e426c..d138aabcf 100644 --- a/package.json +++ b/package.json @@ -3461,7 +3461,7 @@ "fast-glob": "3.3.3", "fast-sort": "3.4.1", "get-east-asian-width": "1.6.0", - "globals": "17.7.0", + "globals": "17.8.0", "has-flag": "5.0.1", "html5parser": "catalog:", "libnpmexec": "10.3.1", @@ -3501,7 +3501,7 @@ "tar-fs": "catalog:", "tar-stream": "3.2.0", "taze": "catalog:", - "type-coverage": "2.29.7", + "type-coverage": "2.30.1", "typescript": "catalog:", "validate-npm-package-name": "6.0.2", "vitest": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 23e7cc13d..f718b8812 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -269,8 +269,8 @@ catalogs: specifier: 3.0.0 version: 3.0.0 markdownlint-cli2: - specifier: 0.23.1 - version: 0.23.1 + specifier: 0.23.2 + version: 0.23.2 mdast-util-from-markdown: specifier: 2.0.3 version: 2.0.3 @@ -393,9 +393,9 @@ overrides: fast-uri: 3.1.4 globby: 16.2.2 has-flag: 5.0.1 - hono: 4.12.31 + hono: 4.12.32 hosted-git-info: 8.1.0 - ip-address: 10.2.0 + ip-address: 10.3.1 isexe: 3.1.5 js-tokens: 10.0.0 js-yaml: 4.3.0 @@ -417,7 +417,7 @@ overrides: p-map: 7.0.6 pacote: 21.5.1 picomatch: 4.0.5 - postcss: 8.5.22 + postcss: 8.5.23 proc-log: 6.1.0 qs: 6.15.3 rolldown: 1.1.4 @@ -428,7 +428,7 @@ overrides: string-width: 8.2.2 strip-ansi: 7.2.0 supports-color: 10.2.2 - tar: 7.5.21 + tar: 7.5.22 tar-fs: 3.1.3 tar-stream: 3.2.0 tslib: 2.8.1 @@ -598,8 +598,8 @@ importers: specifier: 1.6.0 version: 1.6.0 globals: - specifier: 17.7.0 - version: 17.7.0 + specifier: 17.8.0 + version: 17.8.0 has-flag: specifier: 5.0.1 version: 5.0.1 @@ -620,7 +620,7 @@ importers: version: 15.0.6(supports-color@10.2.2) markdownlint-cli2: specifier: 'catalog:' - version: 0.23.1(supports-color@10.2.2) + version: 0.23.2(supports-color@10.2.2) mdast-util-from-markdown: specifier: 'catalog:' version: 2.0.3(supports-color@10.2.2) @@ -718,8 +718,8 @@ importers: specifier: 'catalog:' version: 19.16.0(patch_hash=77208c02cff936d0f1dbf2ffcc95f6f0def9697d6ba7ca4671c399c8c933c6fd) type-coverage: - specifier: 2.29.7 - version: 2.29.7(typescript@7.0.2) + specifier: 2.30.1 + version: 2.30.1(typescript@7.0.2) typescript: specifier: 'catalog:' version: 7.0.2 @@ -734,7 +734,7 @@ importers: version: 0.3.1(typescript@7.0.2)(vite@8.1.5(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0))(vitest@4.1.10) webpack: specifier: 5.109.0 - version: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22) + version: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23) which: specifier: 7.0.0 version: 7.0.0 @@ -3342,7 +3342,7 @@ packages: resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} engines: {node: '>=18.14.1'} peerDependencies: - hono: 4.12.31 + hono: 4.12.32 '@inquirer/ansi@2.0.7': resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==} @@ -5264,8 +5264,8 @@ packages: resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} engines: {node: 18 || 20 || >=22} - globals@17.7.0: - resolution: {integrity: sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==} + globals@17.8.0: + resolution: {integrity: sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==} engines: {node: '>=18'} globby@16.2.2: @@ -5290,8 +5290,8 @@ packages: resolution: {integrity: sha512-CsNUt5x9LUdx6hnk/E2SZLsDyvfqANZSUq4+D3D8RzDJ2M+HDTIkF60ibS1vHaK55vzgiZw1bEPFG9yH7l33wA==} engines: {node: '>=12'} - hono@4.12.31: - resolution: {integrity: sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==} + hono@4.12.32: + resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==} engines: {node: '>=16.9.0'} hosted-git-info@8.1.0: @@ -5350,8 +5350,8 @@ packages: resolution: {integrity: sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==} engines: {node: ^18.17.0 || >=20.5.0} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.3.1: + resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -5617,8 +5617,8 @@ packages: peerDependencies: markdownlint-cli2: '>=0.0.4' - markdownlint-cli2@0.23.1: - resolution: {integrity: sha512-20JPI5W+HpV1OA+pUM712wgvL4GzYNUvbmhLU8KlEYJ1kCDx4soZ4/Xqd+WkLrPTOKMAn8SfO3zYFrK8GLlwQg==} + markdownlint-cli2@0.23.2: + resolution: {integrity: sha512-eUhcnkSpzURo/o4htSqc7LPDszgOOTknhU4eY/sPHvMCLxnTCYscv1gw1/js/idmaZPisv9ECVEIORcllqjTUw==} engines: {node: '>=22'} hasBin: true @@ -6114,8 +6114,8 @@ packages: resolution: {integrity: sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==} engines: {node: '>=4'} - postcss@8.5.22: - resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} presentable-error@0.0.1: @@ -6400,8 +6400,8 @@ packages: tar-stream@3.2.0: resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==} - tar@7.5.21: - resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==} + tar@7.5.22: + resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} taze@19.16.0: @@ -6495,13 +6495,13 @@ packages: typanion@3.14.0: resolution: {integrity: sha512-ZW/lVMRabETuYCd9O9ZvMhAh8GslSqaUjxmK/JLPCh6l73CvLBiuXswj/+7LdnWOgYsQ130FqLzFz5aGT4I3Ug==} - type-coverage-core@2.29.7: - resolution: {integrity: sha512-bt+bnXekw3p5NnqiZpNupOOxfUKGw2Z/YJedfGHkxpeyGLK7DZ59a6Wds8eq1oKjJc5Wulp2xL207z8FjFO14Q==} + type-coverage-core@2.30.1: + resolution: {integrity: sha512-TFzqUvaZW5bTpKGBj3FwN8bYLsWA/smTOslISDg9rBMrpn5KadMQy9l3q068q+dXkn27CAdyfGTDlsH0PguG3A==} peerDependencies: - typescript: 2 || 3 || 4 || 5 + typescript: 2 || 3 || 4 || 5 || 6 || 7 - type-coverage@2.29.7: - resolution: {integrity: sha512-E67Chw7SxFe++uotisxt/xzB1UxxvLztzzQqVyUZ/jKujsejVqvoO5vn25oMvqJydqYrASBVBCQCy082E2qQYQ==} + type-coverage@2.30.1: + resolution: {integrity: sha512-+Y05UXYBaeonULHdpkc7kr0BF5Ix+IsdI/UzI2S6hnkCacTA4ktpi9EnKWMYyISW6xRaLYIEqK+4fz1GLpHQFg==} hasBin: true type-is@2.1.0: @@ -7055,9 +7055,9 @@ snapshots: '@henrygd/queue@1.2.0': {} - '@hono/node-server@1.19.14(hono@4.12.31)': + '@hono/node-server@1.19.14(hono@4.12.32)': dependencies: - hono: 4.12.31 + hono: 4.12.32 '@inquirer/ansi@2.0.7': {} @@ -7163,7 +7163,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.31) + '@hono/node-server': 1.19.14(hono@4.12.32) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 2.0.0(patch_hash=985a8758e5e2783b13cabb8db054c0ff2a18591eb76a8eaacd7bc3eaae1a6ba5) @@ -7173,7 +7173,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1(supports-color@10.2.2) express-rate-limit: 8.5.2(express@5.2.1(supports-color@10.2.2)) - hono: 4.12.31 + hono: 4.12.32 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -8132,7 +8132,7 @@ snapshots: p-limit: 2.3.0 semver: 7.8.5 strip-ansi: 7.2.0 - tar: 7.5.21 + tar: 7.5.22 tinylogic: 2.0.0 treeify: 1.1.0 tslib: 2.8.1 @@ -8690,7 +8690,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1(supports-color@10.2.2)): dependencies: express: 5.2.1(supports-color@10.2.2) - ip-address: 10.2.0 + ip-address: 10.3.1 express@5.2.1(supports-color@10.2.2): dependencies: @@ -8825,7 +8825,7 @@ snapshots: minipass: 7.1.3 path-scurry: 2.0.2 - globals@17.7.0: {} + globals@17.8.0: {} globby@16.2.2: dependencies: @@ -8858,7 +8858,7 @@ snapshots: has-flag@5.0.1: {} - hono@4.12.31: {} + hono@4.12.32: {} hosted-git-info@8.1.0: dependencies: @@ -8915,7 +8915,7 @@ snapshots: ini@5.0.0: {} - ip-address@10.2.0: {} + ip-address@10.3.1: {} ipaddr.js@1.9.1: {} @@ -9149,11 +9149,11 @@ snapshots: punycode.js: 2.3.1 uc.micro: 2.1.0 - markdownlint-cli2-formatter-default@0.0.6(markdownlint-cli2@0.23.1(supports-color@10.2.2)): + markdownlint-cli2-formatter-default@0.0.6(markdownlint-cli2@0.23.2(supports-color@10.2.2)): dependencies: - markdownlint-cli2: 0.23.1(supports-color@10.2.2) + markdownlint-cli2: 0.23.2(supports-color@10.2.2) - markdownlint-cli2@0.23.1(supports-color@10.2.2): + markdownlint-cli2@0.23.2(supports-color@10.2.2): dependencies: globby: 16.2.2 js-yaml: 4.3.0 @@ -9161,7 +9161,7 @@ snapshots: jsonpointer: 5.0.1 markdown-it: 14.3.0 markdownlint: 0.41.1(supports-color@10.2.2) - markdownlint-cli2-formatter-default: 0.0.6(markdownlint-cli2@0.23.1(supports-color@10.2.2)) + markdownlint-cli2-formatter-default: 0.0.6(markdownlint-cli2@0.23.2(supports-color@10.2.2)) micromatch: 4.0.8 smol-toml: 1.7.0 transitivePeerDependencies: @@ -9420,19 +9420,19 @@ snapshots: minimist@1.2.8: {} - minimizer-webpack-plugin@5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)): + minimizer-webpack-plugin@5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)): dependencies: '@jridgewell/trace-mapping': 0.3.31 jest-worker: 27.5.1 schema-utils: 4.3.3 terser: 5.48.0 - webpack: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22) + webpack: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23) optionalDependencies: '@swc/core': 1.15.43 csso: 5.0.5 esbuild: 0.28.1 lightningcss: 1.32.0 - postcss: 8.5.22 + postcss: 8.5.23 minipass-collect@2.0.1: dependencies: @@ -9497,7 +9497,7 @@ snapshots: nopt: 9.0.0 proc-log: 6.1.0 semver: 7.8.5 - tar: 7.5.21 + tar: 7.5.22 tinyglobby: 0.2.17 undici: 6.27.0 which: 7.0.0 @@ -9703,7 +9703,7 @@ snapshots: proc-log: 6.1.0 sigstore: 4.1.1(supports-color@10.2.2) ssri: 12.0.0 - tar: 7.5.21 + tar: 7.5.22 transitivePeerDependencies: - supports-color @@ -9766,7 +9766,7 @@ snapshots: cssesc: 3.0.0 util-deprecate: 1.0.2 - postcss@8.5.22: + postcss@8.5.23: dependencies: nanoid: 3.3.16 picocolors: 1.1.1 @@ -9996,7 +9996,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.2.0 + ip-address: 10.3.1 smart-buffer: 4.2.0 source-map-js@1.2.1: {} @@ -10107,7 +10107,7 @@ snapshots: - bare-buffer - react-native-b4a - tar@7.5.21: + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -10215,7 +10215,7 @@ snapshots: typanion@3.14.0: {} - type-coverage-core@2.29.7(typescript@7.0.2): + type-coverage-core@2.30.1(typescript@7.0.2): dependencies: fast-glob: 3.3.3 minimatch: 9.0.9 @@ -10224,11 +10224,11 @@ snapshots: tsutils: 3.21.0(typescript@7.0.2) typescript: 7.0.2 - type-coverage@2.29.7(typescript@7.0.2): + type-coverage@2.30.1(typescript@7.0.2): dependencies: chalk: 5.6.2(patch_hash=3e5adfdfa27f0c9e066fe820ac91f77773798f205f5e43ff220b250007196661) minimist: 1.2.8 - type-coverage-core: 2.29.7(typescript@7.0.2) + type-coverage-core: 2.30.1(typescript@7.0.2) transitivePeerDependencies: - typescript @@ -10333,7 +10333,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.5 - postcss: 8.5.22 + postcss: 8.5.23 rolldown: 1.1.4 tinyglobby: 0.2.17 optionalDependencies: @@ -10390,7 +10390,7 @@ snapshots: webpack-sources@3.5.1: {} - webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22): + webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23): dependencies: '@types/estree': 1.0.9 '@types/json-schema': 7.0.15 @@ -10406,7 +10406,7 @@ snapshots: events: 3.3.0 graceful-fs: 4.2.11 mime-db: 1.54.0 - minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)) + minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)) neo-async: 2.6.2 schema-utils: 4.3.3 tapable: 2.3.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 7ecccb994..f041babce 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -56,7 +56,7 @@ catalog: 'ecc-agentshield': 1.4.0 'fast-check': 4.9.0 'html5parser': 3.0.0 - 'markdownlint-cli2': 0.23.1 + 'markdownlint-cli2': 0.23.2 'mdast-util-from-markdown': 2.0.3 'micromark': 4.0.2 'neosanitize': 0.3.0 @@ -151,13 +151,13 @@ minimumReleaseAgeExclude: # verkit — new dev-only transitive of taze 19.16.0 (same owner directive); # exact-pinned so future versions re-soak. -# Refuse transitive dependencies declared via git/tarball/local-tarball -# specs — an npm package shouldn't be allowed to drag in a git URL we -# don't control (bypasses npm registry validation, no provenance, no -# soak window). Direct git deps are still allowed (the test suite at -# pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms -# this). pnpm's current default is `false`; declared explicitly so a -# future flip can't silently change install behavior. + # Refuse transitive dependencies declared via git/tarball/local-tarball + # specs — an npm package shouldn't be allowed to drag in a git URL we + # don't control (bypasses npm registry validation, no provenance, no + # soak window). Direct git deps are still allowed (the test suite at + # pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms + # this). pnpm's current default is `false`; declared explicitly so a + # future flip can't silently change install behavior. blockExoticSubdeps: true confirmModulesPurge: false @@ -254,9 +254,9 @@ overrides: 'has-flag': '5.0.1' # 4.12.25+ clears GHSA-88fw-hqm2-52qc (hono CORS wildcard+credentials reflect), # pulled transitively via @anthropic-ai/claude-agent-sdk. - 'hono': '4.12.31' + 'hono': '4.12.32' 'hosted-git-info': '8.1.0' - 'ip-address': '10.2.0' + 'ip-address': '10.3.1' 'isexe': '3.1.5' # Dedup: js-tokens 4 (@babel/code-frame, CJS require) + 10 (ast-v8-to-istanbul, # ESM import) → 10.0.0. The two majors have incompatible APIs (v4 regex vs v10 @@ -286,7 +286,7 @@ overrides: 'p-map': '7.0.6' 'pacote': '21.5.1' 'picomatch': '4.0.5' - 'postcss': '8.5.22' + 'postcss': '8.5.23' 'proc-log': '6.1.0' 'qs': '6.15.3' # Unify every rolldown resolution to the catalog pin (1.1.0). vite 8.0.14 @@ -301,7 +301,7 @@ overrides: 'strip-ansi': '7.2.0' 'supports-color': '10.2.2' # 7.5.16+ clears GHSA (node-tar PAX size-override parser differential, <=7.5.15). - 'tar': '7.5.21' + 'tar': '7.5.22' # Dedup: tar-fs 2 (dockerode) + 3 (bundled into src/archives) → the catalog # pin, and its tar-stream 2/3 dep along with it → 3.2.0. Both are CJS; # dockerode is the only tar-fs@2 consumer (latent devtool).