From e2bb70536e356c8a375b7c6b0aade496932c7979 Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Fri, 24 Jul 2026 20:59:18 -0700
Subject: [PATCH 1/2] fix(backend): override three advisories pinned by stale
 transitives

Moving the build tooling to devDependencies cleared both brace-expansion
findings, not three as the previous commit message claimed: @prisma/client
declares an optional peer dependency on the prisma CLI, so npm keeps it in the
production graph wherever it is listed.

js-yaml, find-my-way and valibot are each pinned to an exact vulnerable version
by a parent already at its latest release, so no update reaches them. Scoped
overrides limit each bump to the parent that pins it, matching the existing c12
and @hono/node-server entries. Remove them once @nestjs/swagger and prisma
release versions carrying the fixes.
---
 backend/package-lock.json | 18 +++++++++---------
 backend/package.json      |  9 ++++++++-
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/backend/package-lock.json b/backend/package-lock.json
index ecea44bec..b465a8606 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -6784,9 +6784,9 @@
       }
     },
     "node_modules/find-my-way": {
-      "version": "9.6.0",
-      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.6.0.tgz",
-      "integrity": "sha512-Zf4Xve4RymLl7NgaavNebZ01joJ8MfVerOG43wy7SHLO+r+K0C6d/SE0BiR7AV5V1VOCFlOP7ecdo+I4qmiHrQ==",
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.7.0.tgz",
+      "integrity": "sha512-f2JHn75x2JlwUwLenZypgczR7YWMb/uO9BvUXtus+JMgkbIkLADd38cI4EiV+OQqrGo1Zlq6V8wnqMJ8e62wUQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -7789,9 +7789,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
-      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
       "funding": [
         {
           "type": "github",
@@ -11196,9 +11196,9 @@
       "license": "MIT"
     },
     "node_modules/valibot": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
-      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.4.2.tgz",
+      "integrity": "sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==",
       "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
diff --git a/backend/package.json b/backend/package.json
index 43d61d7c0..9f074f3ea 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -71,6 +71,13 @@
   },
   "overrides": {
     "c12": ">=3.3.4 <4",
-    "@hono/node-server": "<3"
+    "@hono/node-server": "<3",
+    "@nestjs/swagger": {
+      "js-yaml": ">=5.2.2"
+    },
+    "@prisma/dev": {
+      "find-my-way": ">=9.7.0",
+      "valibot": ">=1.4.2"
+    }
   }
 }

From 5a75aadc527c14f4d52715fe6c4617a88706195e Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Fri, 24 Jul 2026 23:53:33 -0700
Subject: [PATCH 2/2] fix(backend): bound override ranges to patch releases

Review feedback: >=5.2.2 style ranges would let a future major version in on the
next lockfile refresh. Tilde ranges keep future patch advisories flowing while
never crossing a minor, and each parent pinned a version in the same minor line
anyway. Resolved versions are unchanged at js-yaml 5.2.2, find-my-way 9.7.0 and
valibot 1.4.2.

Left the parent keys unversioned deliberately. Keying them to the installed
parent version would make each override stop applying the moment that parent
updates, silently reintroducing the advisory if the new release still carries
the old pin.
---
 backend/package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 9f074f3ea..8a89b6a6d 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -73,11 +73,11 @@
     "c12": ">=3.3.4 <4",
     "@hono/node-server": "<3",
     "@nestjs/swagger": {
-      "js-yaml": ">=5.2.2"
+      "js-yaml": "~5.2.2"
     },
     "@prisma/dev": {
-      "find-my-way": ">=9.7.0",
-      "valibot": ">=1.4.2"
+      "find-my-way": "~9.7.0",
+      "valibot": "~1.4.2"
     }
   }
 }