# fix\(deps\): update packages with high and critical security advisories · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/7494b70869550b7fa4cebbe952e8d23d14679d54)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 7494b70869550b7fa4cebbe952e8d23d14679d54

Requested commit: 7494b70869550b7fa4cebbe952e8d23d14679d54

Commit: 7494b70869550b7fa4cebbe952e8d23d14679d54

Tree: 5eb94ec3ee0f7c0333915ece6eee850eef664548

Author: Charles Tennent

Committer: Charles Tennent

## Message

```
fix(deps): update packages with high and critical security advisories

osv-scanner reported 13 high or critical advisories in pnpm-lock.yaml on
main. This moves every one that has a fixed release onto it:

- @modelcontextprotocol/sdk 1.29.0 -> 1.32.0 (server, GHSA-22jm-h49p-29qw)
- dompurify 3.4.16 -> 3.4.17 (web, GHSA-cg2g-xh64-v4q7)
- sharp 0.35.4 -> 0.35.5 (marketing and scripts, GHSA-wq5f-xc86-pv6w)
- seroval 1.5.4 -> 1.7.0 (TanStack Router, GHSA-p6vx-979v-rg4c)
- shell-quote 1.10.0 -> 1.12.0 (react-devtools-core, GHSA-pqg4-j6r4-53mv)
- proxy-addr 2.0.7 -> 2.0.8 (express, GHSA-jqcg-44mw-7w3h)
- source-map-js 1.2.1 -> 1.2.2 (magicast, GHSA-68fv-2mgg-jv7q)
- path-to-regexp 6.1.0 -> 6.3.0 (@vercel/routing-utils, GHSA-9wv6-86v2-598j)

The transitive bumps stay inside their parents' ranges. The exception is
@vercel/routing-utils, which pins path-to-regexp 6.1.0 exactly, so it gets
an override.

Still open: braces, node-forge and http-cache-semantics have no fixed
release, and uuid 7.0.3 under Expo's xcode needs a major bump.

Done with Claude Opus 5.5 in Claude Code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

```

## Parents

- [51273020db3245f4ec29514a419d29b5dcb012dc](https://git.cafe/pingdotgg/t3code/commit/51273020db3245f4ec29514a419d29b5dcb012dc?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/7494b70869550b7fa4cebbe952e8d23d14679d54?format=markdown)