From 7676ce79dc5a713fbfbd1e8568ca67720b125489 Mon Sep 17 00:00:00 2001
From: Ben <benbart02@gmail.com>
Date: Fri, 4 Sep 2026 11:07:08 -0400
Subject: [PATCH] chore(security): bump @humanfs/node to ^0.16.8
 (GHSA-p498-v437-472g, alert #74)

Closes Dependabot alert #74 / GHSA-p498-v437-472g (medium): @humanfs/node
copyAll() dereferences symlinks, allowing data outside the source tree to be
copied. Dev-scope only; the sole parent is eslint (requests ^0.16.6, which
accepts the patched 0.16.8), so a global override is safe.

Resolved 0.16.6 -> 0.16.8 via `npm install --package-lock-only`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 package-lock.json | 28 +++++++++++++++++-----------
 package.json      |  3 ++-
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e65bea3..f27f206 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -187,35 +187,41 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.6",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
-        "@humanwhocodes/retry": "^0.3.0"
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
-    "node_modules/@humanfs/node/node_modules/@humanwhocodes/retry": {
-      "version": "0.3.1",
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
-        "node": ">=18.18"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18.18.0"
       }
     },
     "node_modules/@humanwhocodes/module-importer": {
diff --git a/package.json b/package.json
index 2e1bb75..1604b3d 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "js-yaml": "^4.3.1",
     "nanoid": "^3.3.18",
     "postcss": "$postcss",
-    "sharp": "^0.35.0"
+    "sharp": "^0.35.0",
+    "@humanfs/node": "^0.16.8"
   }
 }