[chhoumann]

Clears both critical advisories and 9 of the 10 high ones reported by pnpm audit, along with 6 of the 9 moderate ones. Every affected package is a dev dependency. The production main.js is byte-identical to a master build.

Advisories fixed

Severity	Package	Advisory	Before -> after	Path
critical	tinypool	GHSA-5gmw-xhrv-c9v3	2.1.0 -> 2.1.2	obsidian-e2e > vite-plus > oxfmt
critical	tinypool	GHSA-85c8-ppgw-ccpr	2.1.0 -> 2.1.2	obsidian-e2e > vite-plus > oxfmt
high	vite	GHSA-587h-7wmj-h5pm	8.3.1 -> 8.3.5	direct
high	brace-expansion	GHSA-6j4f-fj2g-mc7p	1.1.18 -> 1.1.21, 2.1.4 -> 2.1.7	eslint > minimatch; eslint-plugin-obsidianmd > ... > minimatch
high	brace-expansion	GHSA-qhr7-859c-m2p7	same	same
high	fast-uri	GHSA-58mr-gqgx-xq4g	3.1.6 -> 3.1.9	eslint-plugin-obsidianmd > ... > ajv
high	fast-uri	GHSA-qw65-cvwx-89v3	same	same
high	js-yaml	GHSA-2883-xcg3-v3hh	4.3.1 -> 4.3.2	eslint > @eslint/eslintrc
high	source-map-js	GHSA-68fv-2mgg-jv7q	1.2.1 -> 1.2.2	@vitest/coverage-v8 > magicast
moderate	vite	GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw	8.3.1 -> 8.3.5	direct
moderate	brace-expansion	GHSA-q2hr-2g5m-vwhr (x2)	as above	as above
moderate	fast-uri	GHSA-hrr3-gc8f-f4qj	3.1.6 -> 3.1.9	as above
moderate	postcss-selector-parser	GHSA-rj75-hqrm-r3gf	7.1.5 -> 7.1.7	svelte-eslint-parser
moderate	moment	GHSA-4p3w-j4w9-5jqw	2.29.4 -> 2.31.0	obsidian

Changes

• tinypool is pinned to exactly 2.1.2, following build(deps): pin tinypool and postcss-nested past open advisories quickadd#2241. oxfmt 0.52.0 pins tinypool to =2.1.0, so this is the smallest move past both advisories.
• The vite devDependency floor is now ^8.3.3.
• The existing brace-expansion, fast-uri and js-yaml overrides move up to the patched versions. New overrides in the same range-keyed style cover moment, postcss-selector-parser and source-map-js.
• moment only reaches the tree through the obsidian type package. The plugin never imports it, and esbuild marks obsidian as external, so the override only affects type declarations. Typecheck passes against 2.31.0.

Still open: vite-plus (1 high, 2 moderate)

vite-plus 0.1.24 has GHSA-587h-7wmj-h5pm (high), GHSA-698v-4r3x-3vcv and GHSA-r825-w8mm-5pxw. All three are launch-editor issues that only affect Windows. The only fix is vite-plus >= 1.1.0, but obsidian-e2e (up to 0.13.0) declares the peer as vite-plus: ^0.1.11. vite-plus 1.x also brings vitest 5. MetaEdit never imports vite-plus. pnpm's auto-install-peers installs it for obsidian-e2e, and only its obsidian-e2e/matchers entry point uses it, which this repo doesn't import. Forcing 1.x here would break obsidian-e2e's declared contract. The fix belongs in obsidian-e2e: widen the peer range or make it optional.

Verification

• pnpm audit: was 2 critical / 10 high / 9 moderate, now 0 critical / 1 high / 2 moderate (only vite-plus is left)
• pnpm install --frozen-lockfile, pnpm run lint, pnpm run build and pnpm run test all pass (19 files, 359 tests)
• The production main.js is byte-identical to a build of master
• obsidian-e2e --help runs. The live Obsidian E2E suite was not run because no runtime code changed.

Release impact

None. Only dev-dependency and lockfile changes, and the bundle is unchanged.

---

Note

Low Risk
Lockfile and devDependency-only security pins; production build is unchanged per PR verification.

Overview
Bumps dev-only dependencies and tightens pnpm overrides to clear most pnpm audit findings without changing the shipped plugin bundle.

The direct vite floor moves from ^8.3.1 to ^8.3.3 (lockfile resolves to 8.3.5), pulling in newer rolldown bindings. Override ranges are raised for brace-expansion, fast-uri, and js-yaml, and new overrides pin patched versions of moment, postcss-selector-parser, source-map-js, and tinypool (exact 2.1.2 for the oxfmt/vite-plus path). pnpm-lock.yaml reflects the transitive graph only—no runtime/source changes.

vite-plus advisories remain because obsidian-e2e still peers on ^0.1.x; the PR description notes that as out of scope here.

^{Reviewed by Cursor Bugbot for commit 94e24c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Override vulnerable transitive dev dependencies and bump Vite to 8.3.3

• Bumps Vite from 8.3.1 to 8.3.3 in package.json and refreshes pnpm-lock.yaml to match
• Adds/raises pnpm overrides for brace-expansion, fast-uri, js-yaml, moment, postcss-selector-parser, postcss, source-map-js, and tinypool to pin vulnerable transitive dev dependencies to fixed versions
• Risk: installs now resolve to the overridden versions whenever the declared package ranges match, so pnpm install output differs for anyone not pulling the lockfile

^{Macroscope summarized 94e24c0.}