Update dependencies and fix security vulnerabilities

[pviti]

Update dependencies and fix security vulnerabilities

Dependency refresh for the commercelayer CLI, the Biome config fix required by the newer linter version, and the resolution of the security alerts reported by Vanta/Dependabot plus the remaining advisories surfaced by pnpm audit.

Security

Alerts reported by Vanta / Dependabot

Severity	Package	Advisory	Path	Fix
High	js-yaml 3.15.0	GHSA-5p4m-2wfm-xmqj — quadratic CPU consumption in !!omap resolution	@commercelayer/cli-ux, @oclif/core	lockfile refresh → 3.15.1
High	brace-expansion 2.1.2	GHSA-rgw5-rvv9-x895 — DoS via unbounded intermediate arrays	minimatch (via @oclif/core, mocha)	lockfile refresh → 2.1.4
High	brace-expansion 5.0.7	GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg — DoS via unbounded expansion	minimatch (via @oclif/core 4.x)	lockfile refresh → 5.0.9

Additional advisories from pnpm audit

Severity	Package	Issue	Path	Fix
High	js-yaml 4.3.0	same !!omap DoS	mocha, semantic-release	lockfile refresh → 4.3.1
High	undici 7.28.0	cross-user information disclosure and parse-time crash via degenerate private cache directives	@semantic-release/github	lockfile refresh → 7.29.0
Moderate	undici 6.27.0 / 7.28.0	response desynchronization via retry interceptor, CRLF injection via blob-like body type, cookie attribute injection, cache-directive disclosure	@actions/http-client, @semantic-release/github	lockfile refresh → 6.28.0 / 7.29.0
High	serialize-javascript 6.0.2	RCE via RegExp.flags / Date.prototype.toISOString(), plus CPU-exhaustion DoS	mocha	override → 7.1.0

How each one is fixed

Lockfile refresh (no override needed). For js-yaml, brace-expansion and undici every dependent already declares a range that admits the patched release — ^3.14.1, ^4.1.0, ^2.0.1, ^5.0.x, ^6.23.0, ^7.0.0 — so regenerating pnpm-lock.yaml is enough. The undici advisories are dev-only in any case: both copies come in through semantic-release, which only runs in CI.

Override. serialize-javascript is the one exception: mocha still pins ^6.0.2 and the fix landed in 7.0.5, so the range cannot resolve to a patched version. It is declared in pnpm-workspace.yaml, since pnpm 11 no longer reads pnpm.overrides from package.json. The entry is scoped to the vulnerable range only (serialize-javascript@<7.0.5) and carries a comment with the reason, so it drops out naturally once mocha ships a fix.

The bump is dev-only — mocha uses the package for parallel-mode worker serialization — and v7 requires Node >= 20, which matches this package's engines.

Unlike the plugin repos, this one has no node-notifier dependency, so there is no uuid alert here, and the installed diff versions (4.0.4 / 5.2.2) fall outside the jsdiff advisory range.

Biome configuration

Biome 2.5 replaces the boolean linter.rules.recommended flag with the linter.rules.preset field, so biome.json now uses "preset": "recommended". Behaviour is unchanged — the same recommended rule set is enabled, with the existing suspicious and style overrides untouched.

pnpm build scripts

pnpm 11 requires build scripts to be explicitly allowed, otherwise pnpm install fails with ERR_PNPM_IGNORED_BUILDS. pnpm-workspace.yaml allows esbuild (its postinstall fetches the platform binary) and yarn.

Dependencies

Package	From	To
@commercelayer/cli-core	^5.11.1	^5.11.3
@commercelayer/cli-ux	^1.2.1	^1.2.3
@commercelayer/sdk	^6.57.0	^6.58.0
@oclif/plugin-autocomplete	^3.2.45	^3.2.56
@oclif/plugin-help	^6.2.44	^6.2.58
@oclif/plugin-not-found	^3.2.80	^3.2.93
@oclif/plugin-plugins	^5.4.61	^5.4.87

Dev dependencies

Package	From	To
@biomejs/biome	^2.4.12	^2.5.8
@commercelayer/cli-dev	^3.1.1	^3.1.9
@types/inquirer	^8.2.12	^8.2.13
@types/node	^25.6.0	^25.9.5
oclif	^4.23.0	^4.23.30
prettier	^3.8.3	^3.9.6
semantic-release	^25.0.3	^25.0.9
tsx	^4.21.0	^4.23.12

Docs

docs/autocomplete.md, docs/help.md and docs/plugins.md regenerated to reference the new oclif plugin versions.

Verification

• pnpm audit — no advisories
• pnpm build, pnpm test (27 passing), pnpm lint (biome, 67 files) — all pass
• pnpm prepack (build + oclif manifest + readme) completes
• CLI smoke-tested via ./bin/run.js: --version, --help, applications --help, login --help, config --help, plugins, and applications run against the local config

[pviti]

🎉 This PR is included in version 6.9.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀