fix(deps): resolve audit findings in root, docsite and examples

[rqbazan]

Summary

Every lockfile in the repo now audits clean (13 lockfiles: the root, 8 pnpm examples, 4 bun examples). A weekly audit and Dependabot security updates keep it that way. @variablelab/env itself was never affected: it only depends on @standard-schema/spec and defu, and its built dist is byte-identical before and after.

 package.json                    vitest 4.1.0 -> 4.1.12
 package/package.json            @vitest/browser-playwright 4.1.0 -> 4.1.12   (devDependency)
 pnpm-workspace.yaml             catalog vite 8.0.11 -> 8.3.4
 docsite/                        (deployed)
   @tanstack/react-start           1.167.65 -> 1.169.3   ┐
   @tanstack/react-router          1.169.2  -> 1.170.45  ├ bumped together
   @tanstack/router-plugin         1.167.35 -> 1.168.47  ┘
   wrangler                        ^4.90.1  -> ^4.151.1
   @cloudflare/vite-plugin         ^1.36.4  -> ^1.64.0
-  createServerFn().inputValidator(...)
+  createServerFn().validator(...)            # renamed in the new TanStack Start
 examples/
   backend-node(-cjs)              hono 4.13.13, @hono/node-server 2.1.5
   backend-bun(-cjs), backend-deno(-cjs)   hono 4.13.13
   worker-cloudflare               hono 4.13.13, wrangler 4.151.1
   edge-nextjs                     next 16.4.2
   spa-vite-dynamic, spa-vite-plugin   vite 8.3.4
   ssr-react-router                react-router + @react-router/* 7.18.4, vite 8.3.4
   ssr-tanstack-start              same TanStack trio as the docsite, vite 8.3.4
 .github/
+  dependabot.yml                  security updates only, root + 8 pnpm examples
+  workflows/dependency-audit.yml  weekly audit of all 13 lockfiles, opens/closes an issue
   zizmor.yml                      + dependabot-cooldown: 1 day

The remaining transitive fixes are targeted refreshes (pnpm update --depth Infinity <pkg>), with no lockfile regenerated.

What was vulnerable

"Dev" is tooling, tests or a build step. "Deployed" is the docsite on Cloudflare. In the examples, "runtime" means the example app's own server code. The examples are never published.

Root workspace (pnpm-lock.yaml: 78 → 0)

Package	Severity	Kind	Path	Fix
@vitest/browser 4.1.0	critical	dev	package > @vitest/browser-playwright	@vitest/browser-playwright 4.1.12
@tanstack/react-start 1.167.65, @tanstack/start-server-core 1.167.30	critical	deployed	docsite	TanStack trio → start-server-core 1.169.44
seroval 1.5.4	critical	deployed	docsite > @tanstack/router-core	1.6.9 via the trio
braces 3.0.3 (no fix upstream)	high	dev	docsite > @tanstack/router-plugin > chokidar 3	removed: router-plugin 1.168 uses chokidar 5
vite 8.0.11, postcss 8.5.15, nanoid 3.3.12	high	dev	catalog vite	vite 8.3.4 (postcss 8.5.30, nanoid 3.3.20)
undici 7.24/7.26, ws 8.20.1, sharp 0.34.5	high	dev	docsite > @cloudflare/vite-plugin > miniflare	wrangler and @cloudflare/vite-plugin refresh (undici 7.29.1, ws 8.21/8.22, sharp 0.35.5)
browserslist 4.28.2, baseline-browser-mapping 2.10.32	high / moderate	dev	docsite > router-plugin > @babel/core	refresh → 4.29.3, 2.11.29
js-yaml 4.1.1, brace-expansion 5.0.6, source-map-js 1.2.1	high	dev	root > @rrlab/biome-plugin, @rrlab/cli	refresh → 4.3.2, 5.0.12, 1.2.2
vitest, @vitest/mocker 4.1.0	moderate	dev	root	vitest 4.1.12
esbuild 0.27.3/0.28.0	low	dev	docsite > vite, wrangler, fumadocs-mdx	refresh → 0.28.2

Examples

Package	Severity	Kind	Examples	Fix
next 16.2.6 (+ its postcss 8.4.31, sharp, nanoid, baseline-browser-mapping)	critical	runtime	edge-nextjs	next 16.4.2
proxy-addr 2.0.7	critical	runtime	ssr-react-router > @react-router/serve > express	2.0.8
@tanstack/react-start, start-server-core, seroval, braces, undici	critical	runtime / dev	ssr-tanstack-start	same trio as the docsite
hono 4.12.18	high	runtime	backend-*, worker-cloudflare	4.13.13
react-router 7.15.0	high	runtime	ssr-react-router	7.18.4
compression 1.8.1, qs 6.15.1, morgan 1.10.1, body-parser 1.20.5	high – low	runtime	ssr-react-router > @react-router/serve	compression 1.8.2, express 4.22.3 (qs 6.16.1), morgan 1.12.1, body-parser 1.20.8
vite 7.3.3, esbuild 0.27.7, valibot 1.4.0, @babel/core 7.29.0	high – low	dev	ssr-react-router > @react-router/dev (> vite-node)	vite 7.3.7, esbuild 0.28.2, valibot 1.5.0, @babel/core 7.29.7
undici, ws, sharp, esbuild	high	dev	worker-cloudflare > wrangler	wrangler 4.151.1
vite 8.0.11, postcss, nanoid	high	dev	spa-vite-, ssr-	vite 8.3.4
@hono/node-server 2.0.2	moderate	runtime	backend-node(-cjs)	2.1.5
js-yaml, brace-expansion, source-map-js	high	dev	all 12 examples > @rrlab/cli, @rrlab/biome-plugin	refresh → 4.3.2, 5.0.12, 1.2.2

Notes for reviewers

• Cooldown in the examples. --ignore-workspace stops pnpm from reading minimumReleaseAge in pnpm-workspace.yaml, so the examples were installed with npm_config_minimum_release_age=1440. Then every new version in all 13 lockfiles was checked against npm view <pkg> time: none is younger than 24 h.
• bun.lock. bun 1.2.4 (the version the examples pin) has no targeted transitive update: bun update <pkg> adds the package as a direct dependency, and dropping lock entries re-resolves the whole tree. So the brace-expansion, js-yaml and source-map-js entries were rewritten to the fixed versions with the registry integrity (their dependencies are unchanged). bun install --frozen-lockfile accepts the result, and a plain bun install leaves it unchanged.
• ssr-react-router. pnpm kept vite-node's locked vite 7.3.3 even under pnpm update --depth Infinity vite, so those two lock entries were dropped and re-resolved (vite 7.3.7). That let esbuild move to 0.28.2.
• Generated files. docsite/src/routeTree.gen.ts is the router-plugin 1.168.47 output (it only reorders routes). examples/edge-nextjs/next-env.d.ts is what next dev 16.4 writes (it adds one import).
• Tarball integrity. package/package.json changed, so the packed @variablelab/env tarball changed too, and its integrity line moved in each example's pnpm lockfile. The pnpm install forces that change.
• srvx. ssr-tanstack-start now has srvx 0.11.15 (its direct dependency, used by serve.js) alongside 1.0.5 (a build-time dependency of start-plugin-core). e2e passes.

Overrides and changesets

None. No pnpm or npm overrides. No changeset: the published package's dependencies and peerDependencies are unchanged, and package/dist is byte-identical before and after (diff -r on a rr pack build).

Maintenance files

• .github/dependabot.yml: security updates only (open-pull-requests-limit: 0, cooldown.default-days: 1, one security group). The npm entry covers / plus the 8 pnpm examples, and github-actions covers /. The bun examples are left out with a comment, because Dependabot has no security updates for bun.lock. The weekly audit covers them instead.
• .github/workflows/dependency-audit.yml: the shared template. Only the REPO-SPECIFIC lines differ:
  • pnpm audit for the root.
  • pnpm -C examples/<x> audit --ignore-workspace for each pnpm example, which audits the example's own lockfile.
  • bun audit for each bun example. It needs bun ≥ 1.2.15, but those examples pin 1.2.4, and mise's locked mode refuses mise x bun@<other>. So the step runs pnpm dlx bun@1.4.3 audit from inside each example, through the root pnpm. The version is exact, checked against the registry integrity and subject to minimumReleaseAge.
• .github/zizmor.yml: adds the dependabot-cooldown rule (1 day, matching minimumReleaseAge).
• README: no change. It has no CI or security section to extend.

The org admin enables the dependency graph and Dependabot security updates for this repo separately. These files do nothing until both are on.

Evidence

• Before: pnpm audit (root): 78 vulnerabilities found (12 low | 27 moderate | 33 high | 6 critical). Per example (pnpm audit --ignore-workspace / bun audit): backend-node 33, backend-node-cjs 33, edge-nextjs 38, spa-vite-dynamic 17, spa-vite-plugin 17, ssr-react-router 40, ssr-tanstack-start 47, worker-cloudflare 58, each bun example 31.
  After: all 13 lockfiles audit clean (No known vulnerabilities found / No vulnerabilities found).
• Audit step dry run: the step script ran in a fresh clone with no node_modules and MISE_LOCKED=1, and printed found=false without touching any file. In the negative control, the same clone with origin/main's examples/backend-node/pnpm-lock.yaml and examples/backend-deno-cjs/bun.lock printed found=true, and the report listed both labels.
• What CI runs (fresh clone): pnpm install --frozen-lockfile, mise run check, mise run lib:test (93 passed), mise run lib:build, and the docsite build (pnpm --filter docsite build: exit 0, docs pages prerendered through the renamed server function).
• Examples: rr check passes in all 12. e2e passes locally in all 12, including the three *-cjs examples that e2e.yml doesn't cover: backend-node 6, backend-node-cjs 6, backend-bun 6, backend-bun-cjs 6, backend-deno 6, backend-deno-cjs 6, worker-cloudflare 2, edge-nextjs 2, spa-vite-dynamic 3, spa-vite-plugin 5, ssr-react-router 4, ssr-tanstack-start 5. next build for edge-nextjs passes with DATABASE_URL set (without it, env validation fails the build, as intended).
• zizmor: pipx run --spec zizmor==1.30.1 zizmor --offline . reports no findings.

Merge Danger

Door: two-way

Dependency bumps and new CI files. Reverting the PR restores everything.

Blast Radius: docsite

The docsite is the only deployed surface. It takes a TanStack Start minor (1.167 → 1.169), including the inputValidator → validator rename. The build and the prerender pass locally. Consumers of @variablelab/env are unaffected (identical dist, unchanged dependencies). The new audit workflow runs only on its schedule or on manual dispatch. It never runs on PRs, so it can't block them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8842e87

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vland-bot]

Preview release

Latest commit: 8842e87

Some packages have been released:

Package	Version	Install
@variablelab/env	0.5.5-git-8842e87.0	@variablelab/env@0.5.5-git-8842e87.0

Note

Use the PR number as tag to install any package. For instance:

pnpm add @variablelab/env@pr-46