From f742de4532abdd0d69c86def21b68297020c5d1b Mon Sep 17 00:00:00 2001 From: renantatsuo Date: Tue, 11 Aug 2026 18:33:36 +0100 Subject: [PATCH 1/3] chore(devtools): bump launch-editor and picomatch --- packages/devtools-bundler-core/package.json | 4 +-- pnpm-lock.yaml | 28 ++++++++++++++++++--- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/packages/devtools-bundler-core/package.json b/packages/devtools-bundler-core/package.json index 65a4ab06c..5e7dc7c90 100644 --- a/packages/devtools-bundler-core/package.json +++ b/packages/devtools-bundler-core/package.json @@ -54,10 +54,10 @@ "@tanstack/devtools-client": "workspace:*", "@tanstack/devtools-event-bus": "workspace:*", "chalk": "^5.6.2", - "launch-editor": "^2.11.1", + "launch-editor": "^2.14.1", "magic-string": "^0.30.0", "oxc-parser": "^0.120.0", - "picomatch": "^4.0.3" + "picomatch": "^4.0.5" }, "devDependencies": { "@types/picomatch": "^4.0.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1777116b0..3d800db95 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1607,8 +1607,8 @@ importers: specifier: ^5.6.2 version: 5.6.2 launch-editor: - specifier: ^2.11.1 - version: 2.13.2 + specifier: ^2.14.1 + version: 2.14.1 magic-string: specifier: ^0.30.0 version: 0.30.21 @@ -1616,8 +1616,8 @@ importers: specifier: ^0.120.0 version: 0.120.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1) picomatch: - specifier: ^4.0.3 - version: 4.0.4 + specifier: ^4.0.5 + version: 4.0.5 devDependencies: '@types/picomatch': specifier: ^4.0.2 @@ -9057,6 +9057,9 @@ packages: launch-editor@2.13.2: resolution: {integrity: sha512-4VVDnbOpLXy/s8rdRCSXb+zfMeFR0WlJWpET1iA9CQdlZDfwyLjUuGQzXU4VeOoey6AicSAluWan7Etga6Kcmg==} + launch-editor@2.14.1: + resolution: {integrity: sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==} + layout-base@1.0.2: resolution: {integrity: sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg==} @@ -10232,6 +10235,10 @@ packages: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} + picomatch@4.0.5: + resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==} + engines: {node: '>=12'} + pify@4.0.1: resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==} engines: {node: '>=6'} @@ -10821,6 +10828,10 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} + shell-quote@1.10.0: + resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==} + engines: {node: '>= 0.4'} + shell-quote@1.8.3: resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} engines: {node: '>= 0.4'} @@ -19870,6 +19881,11 @@ snapshots: picocolors: 1.1.1 shell-quote: 1.8.3 + launch-editor@2.14.1: + dependencies: + picocolors: 1.1.1 + shell-quote: 1.10.0 + layout-base@1.0.2: {} layout-base@2.0.1: {} @@ -21579,6 +21595,8 @@ snapshots: picomatch@4.0.4: {} + picomatch@4.0.5: {} + pify@4.0.1: {} pirates@4.0.7: {} @@ -22326,6 +22344,8 @@ snapshots: shebang-regex@3.0.0: {} + shell-quote@1.10.0: {} + shell-quote@1.8.3: {} sherif-darwin-arm64@1.11.1: From bcae55c14286026068286dcd7ee43fc7e85cc653 Mon Sep 17 00:00:00 2001 From: renantatsuo Date: Tue, 11 Aug 2026 18:49:49 +0100 Subject: [PATCH 2/3] chore: add changeset for launch-editor and picomatch bumps --- .changeset/olive-experts-look.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/olive-experts-look.md diff --git a/.changeset/olive-experts-look.md b/.changeset/olive-experts-look.md new file mode 100644 index 000000000..4274ef1c8 --- /dev/null +++ b/.changeset/olive-experts-look.md @@ -0,0 +1,5 @@ +--- +'@tanstack/devtools-bundler-core': patch +--- + +chore: bump launch-editor to ^2.14.1 and picomatch to ^4.0.5 to resolve security advisories in shell-quote (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv) and picomatch (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p) From 3184d79ea3b7f4cb507c52d34bc56a0ba74ae017 Mon Sep 17 00:00:00 2001 From: renantatsuo Date: Wed, 12 Aug 2026 17:04:04 +0100 Subject: [PATCH 3/3] chore: clarify changeset scope and remaining dev-only shell-quote --- .changeset/olive-experts-look.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.changeset/olive-experts-look.md b/.changeset/olive-experts-look.md index 4274ef1c8..1db89d4fd 100644 --- a/.changeset/olive-experts-look.md +++ b/.changeset/olive-experts-look.md @@ -3,3 +3,5 @@ --- chore: bump launch-editor to ^2.14.1 and picomatch to ^4.0.5 to resolve security advisories in shell-quote (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv) and picomatch (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p) + +This only covers the `@tanstack/devtools-bundler-core` dependency path — its `launch-editor` dependency now resolves the patched `shell-quote@1.10.0`, and `picomatch` resolves `4.0.5`. A vulnerable `shell-quote@1.8.3` remains in the lockfile via `launch-editor@2.13.2`, pulled in by `@rspack/dev-server` in the `react-rspack-example` app's devDependencies; it is development-only and does not affect any published package.