chore(deps): resolve open Dependabot security alerts

[rossnelson]

Clears the open Dependabot security alerts by refreshing dependency resolutions on a branch cut from current main, rather than landing the stale Dependabot PRs individually.

Every package changed here has its own alert. Nothing unalerted was touched.

Go — both modules, to grpc 1.83.2

• server/ 1.82.1 -> 1.83.2
• utilities/demo/scenarios/agentcore-serverless-worker/worker/ 1.82.1 -> 1.83.2

These are the only two go.mod files in the repo.

This also covers temporalio/ui-server, which has 3 open grpc alerts of its own. That repo is a pure downstream mirror — .github/actions/download-and-build-ui/action.yaml does cp -r ui-release/server/* ./, so its go.mod is server/go.mod (it even declares module github.com/temporalio/ui-server/v2). No PR is needed there. Its alerts clear on the next ui release, since that sync is release-triggered rather than merge-triggered.

JS (pnpm.overrides)

Existing overrides that had drifted below their patched version, raised:

package	was	now
svgo@>=2 <3	^2.8.3	>=2.8.4 <2.9.0
qs	>=6.15.2	>=6.16.0
protobufjs	^7.5.5	>=7.6.5 <7.7.0
fast-uri	>=3.1.5 <4	>=3.1.6 <3.2.0
joi	>=17.13.4 <18	>=17.13.6 <17.14.0
js-yaml@>=3 <4	>=3.15.1 <4	>=3.15.2 <4
nanoid@>=3 <4	>=3.3.17 <4	>=3.3.18 <4

Added for the remaining alerted transitives: @grpc/grpc-js, @humanfs/node, baseline-browser-mapping, browserslist, js-yaml@>=4 <5, postcss-selector-parser@>=6 <7, smol-toml.

Why the ranges have ceilings

Open-ended >= overrides resolve to whatever is newest, not to the fix. Left uncapped, smol-toml resolved to 1.8.0 when the advisory only needed 1.7.1. Each override is now capped at the patched minor, so resolution lands on the fix — smol-toml resolves 1.7.2. Patch drift inside the patched minor is left alone on purpose, so future patch-level fixes still flow.

Two ceilings exist for compatibility rather than restraint:

• @humanfs/node at <0.17 — 0.17.0 requires Node >=24 and this repo targets Node 22. Without the ceiling, pnpm install fails outright with ERR_PNPM_UNSUPPORTED_ENGINE.
• js-yaml is split into >=3 <4 and >=4 <5 lines because both majors are present in the tree and each has its own advisory.

Deliberately not fixed

vitest stays at 3.2.6. Its alert needs the 4.x major — real work, its own PR. That leaves 3 alerts open here (vitest x2, @vitest/mocker).

Verification

CI green, 17/17. Locally: pnpm lint (0 errors), pnpm check (888 files, 0 errors), pnpm vitest run (255 files, 3308 passed), pnpm build:local, plus go build / go vet / go test in both Go modules.

Note for reviewers: the existing Dependabot PRs fail lint with 187 stylelint errors (Invalid prelude "bg-surface-secondary" for @apply). That is stale-base drift, not the bumps — a branch cut from current main lints clean, as this one does.

Relationship to the open Dependabot PRs

Superseded: #3897 (smol-toml), #3895 (js-yaml), #3873 and #3919 (grpc — this takes both modules to 1.83.2, a patch ahead of #3873).

Left alone, all needing their own major-version work: #3896 (vitest 4), #3832 (jsdom 30), #3827 (tailwind 4), #3829 (github-script 9), #3828 (setup-go 7), #3830 (chromaui 18), #3831 (release-drafter 7.7), #3826, #3825, #3458, #3418.

Nothing merged or closed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
holocene	Ready	Preview	Sep 14, 2026 11:09pm UTC