pnpm dependency update 2026-07-03

[commercelayer-ci]

Dependency update

Closes #204
Branch: chore/deps-update-202607031017
Based on stable: v6.9.4
Prerelease tag: v6.9.5-auto-deps-202607031017.0
Node.js: 20.x
pnpm: 10.x

Automated dependency update via pnpm. Review the dependency diff and validation output before merging.

Dependency update results

• Check: success
• Build: success
• Test: failure

Test output

Semver bump log

No semver updates found.

Audit log

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Serialize JavaScript is Vulnerable to RCE via          │
│                     │ RegExp.flags and Date.prototype.toISOString()          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ serialize-javascript                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.0.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>mocha>serialize-javascript                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-5c6j-r48x-rmvq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Serialize JavaScript has CPU Exhaustion Denial of      │
│                     │ Service via crafted array-like objects                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ serialize-javascript                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <7.0.5                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.0.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>mocha>serialize-javascript                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-qj8w-gfj5-8c6v      │
└─────────────────────┴────────────────────────────────────────────────────────┘
2 vulnerabilities found
Severity: 1 moderate | 1 high

Major updates log not updated

package.json
  @commercelayer/sdk      ^6.58.0  →   ^7.12.0
  @oclif/core             ^3.27.0  →  ^4.11.14
  @oclif/plugin-plugins   ^5.4.81  →   ^5.4.82
  @oclif/test             ^3.2.15  →   ^4.1.20
  @types/configstore       ^4.0.0  →    ^6.0.2
  @types/inquirer         ^8.2.13  →   ^9.0.10
  @types/node             ^25.9.4  →   ^26.1.0
  @types/update-notifier   ^5.1.0  →    ^6.0.8
  configstore              ^5.0.1  →    ^8.0.0
  inquirer                 ^8.2.7  →   ^14.0.2
  mocha                   ^10.8.2  →   ^11.7.6
  tsx                     ^4.22.4  →   ^4.22.5
  typescript               ^5.9.3  →    ^6.0.3