fix(deps): resolve critical and high security vulnerabilities

[intech]

Summary

• Override basic-ftp >=5.2.0 for CVE-2026-27699 (CRITICAL)
• Override rollup >=4.59.0 for CVE-2026-27606 (HIGH)
• Override minimatch >=10.2.3 for CVE-2026-26996, CVE-2026-27903 (HIGH)

All vulnerabilities are transitive — direct dependency updates don't resolve them. pnpm overrides force the patched versions.

Test plan

• pnpm install — lockfile updated
• pnpm build — 10/10 tasks successful
• pnpm typecheck — no errors
• pnpm test — pre-existing flaky tests only (unrelated to overrides)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Resolved critical and high severity security vulnerabilities through dependency updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 484f32f2-16f0-4ee7-afb4-d86ba0811c9d

📥 Commits

Reviewing files that changed from the base of the PR and between afaee1d and e05ed60.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• .changeset/security-overrides.md
• package.json

---

📝 Walkthrough

Walkthrough

This pull request updates package.json pnpm overrides to resolve critical and high severity vulnerabilities (CVE-2026-27699, CVE-2026-27606, CVE-2026-26996, CVE-2026-27903) affecting basic-ftp, rollup, and minimatch. A corresponding changelog entry documents the security fix.

Changes

Cohort / File(s)	Summary
Security Changelog Entry .changeset/security-overrides.md	New changelog documenting resolution of four critical/high severity CVEs via pnpm dependency overrides.
Dependency Overrides package.json	Updates pnpm.overrides to pin patched versions: minimatch@<10.2.3 → "10.2.3", basic-ftp@<5.2.0 → "5.2.0", rollup@>=4.0.0 <4.59.0 → "4.59.0".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• fix(deps): bump ajv to 8.18.0 (CVE-2025-69873) #28: Modifies pnpm.overrides to pin alternative patched dependency versions for security fixes.
• fix(deps): override minimatch >=10.2.1 to fix ReDoS (Dependabot #2) #33: Updates the pnpm.overrides entry for minimatch, directly related to the minimatch version upgrade in this PR.

Suggested labels

dependencies

Poem

🐰 A hoppy fix for security's sake,
Overrides pinned to patch the break,
CVEs quashed with versions new,
Minimatch, rollup, and ftp too!
Dependencies secured, no more at stake!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: applying pnpm overrides to resolve critical and high security vulnerabilities in transitive dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/security-overrides

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@connectum/auth

npm i https://pkg.pr.new/@connectum/auth@37

@connectum/cli

npm i https://pkg.pr.new/@connectum/cli@37

@connectum/core

npm i https://pkg.pr.new/@connectum/core@37

@connectum/healthcheck

npm i https://pkg.pr.new/@connectum/healthcheck@37

@connectum/interceptors

npm i https://pkg.pr.new/@connectum/interceptors@37

@connectum/otel

npm i https://pkg.pr.new/@connectum/otel@37

@connectum/reflection

npm i https://pkg.pr.new/@connectum/reflection@37

commit: 19fa03f