[Hanssen0-Alter-Ego]

Consolidate the compatible dependency updates from #606 into #609:

Dependency	Locked version
bn.js	4.12.2 → 4.12.3
minimatch	3.1.2 → 3.1.5
brace-expansion	1.1.12 / 5.0.7 → 1.1.21 / 5.0.12
Immutable	4.3.7 → 4.3.9
markdown-it	14.3.0 → 14.3.3
Handlebars	4.7.9 → 4.7.10
Vite / esbuild	7.3.5 / 0.27.7 → 7.3.7 / 0.28.2

Only pnpm-lock.yaml changes. All selected versions satisfy the existing upstream dependency ranges; no overrides, manifest changes, unrelated version rollbacks, or release changesets are introduced. The final tree exactly matches the three-way combination of the previous #606 and #609 heads.

Published dependency manifests and runtime JavaScript bundles remain unchanged. This improves repository installs and private app builds; it does not enforce new transitive minimums or replace existing lockfiles for downstream npm consumers.

Validation for c9d4f07 on Node 24.19.0 with pinned pnpm 11.8.0:

• Frozen installation passed all 2,009 supply-chain-policy entries.
• Full workspace lint passed.
• All 623 tests across 60 files passed, including CJS and ESM smoke tests.
• Public package builds and the app, Playground, faucet and examples builds passed.
• Combined regressions passed for the actual bn.js crypto dependency chain, copyfiles/minimatch, both brace-expansion families, Lumos transactions, Markdown, Handlebars and esbuild.
• The combined public build matched all 800 baseline artifact/manifest hashes. Earlier identical builds showed Spore declaration field-order variation, so this is not a claim of strict build reproducibility.
• Fresh independent review passed: the exact union tree, 2,025 snapshots, 5,259 dependency references, 54 upstream version constraints, 35 registry integrity records and ten actual tarball SHA-512 digests were verified. Six independent combined behavior groups also passed.
• Local build:all was attempted but docs' Google Fonts download was blocked by the environment proxy with HTTP 403.
• Exact-head Node 26 repository CI passed installation, build, lint and tests: https://github.com/ckb-devrel/ccc/actions/runs/39063312214. All four Netlify previews (apiccc, docsccc, liveccc and appccc) passed.
• Windows-specific esbuild development-server behavior was not reproduced on Linux.

Remaining scope:

• The legacy TypeScript-ESLint chain still exact-pins minimatch 9.0.3. The minimatch 3.x update does not claim that every possible ReDoS input is eliminated; current copyfiles scripts use a fixed pattern.
• Monaco Editor still exact-pins DOMPurify 3.4.15, with no newer compatible upstream release available.
• sprintf-js and Elliptic have no available published patched version for the relevant advisories. Updating bn.js does not fix the separate Elliptic advisory.
• Mermaid's KaTeX update remains in chore(deps): bump the production-dependencies group across 1 directory with 22 updates #601. Integrating chore(deps): bump the production-dependencies group across 1 directory with 22 updates #601 will require resolving lockfile peer-record conflicts while preserving these patched resolutions.
• The audit snapshot falls from 34 to 10 records, with one critical record still present. This PR does not claim to clear every security advisory.

Official advisories: bn.js, minimatch, brace-expansion, Immutable List, Immutable Map/Set, markdown-it linkify, markdown-it reference parsing, markdown-it HTML parsing, Handlebars, esbuild, Vite.

Generated by ChatGPT · Alter Ego

[changeset-bot]

⚠️ No Changeset found

Latest commit: c9d4f07

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for apiccc ready!

Name	Link
🔨 Latest commit	c9d4f07
🔍 Latest deploy log	https://app.netlify.com/projects/apiccc/deploys/6ad3cea1d867988952423356
😎 Deploy Preview	https://deploy-preview-609--apiccc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 82 (🔴 down 7 from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 95 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1c833707-4c2e-4989-abdb-388407249c56

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for docsccc ready!

Name	Link
🔨 Latest commit	c9d4f07
🔍 Latest deploy log	https://app.netlify.com/projects/docsccc/deploys/6ad3cea157ba507320a6cd8b
😎 Deploy Preview	https://deploy-preview-609--docsccc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 76 (🔴 down 16 from production) Accessibility: 95 (no change from production) Best Practices: 92 (🔴 down 8 from production) SEO: 75 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for liveccc ready!

Name	Link
🔨 Latest commit	c9d4f07
🔍 Latest deploy log	https://app.netlify.com/projects/liveccc/deploys/6ad3cea1cedf8cba8ba79fa6
😎 Deploy Preview	https://deploy-preview-609--liveccc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 10 (🔴 down 2 from production) Accessibility: 88 (no change from production) Best Practices: 92 (🔴 down 8 from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for appccc ready!

Name	Link
🔨 Latest commit	c9d4f07
🔍 Latest deploy log	https://app.netlify.com/projects/appccc/deploys/6ad3cea1f4f501797f9eb06c
😎 Deploy Preview	https://deploy-preview-609--appccc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 39 (🔴 down 23 from production) Accessibility: 98 (🟢 up 1 from production) Best Practices: 92 (🔴 down 8 from production) SEO: 99 (🟢 up 11 from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Hanssen0]

LGTM