fix(website): pin brace-expansion and fast-uri past new advisories

[clay-good]

Status: LGTM. Fixes the red Security workflow on main.

What was wrong: after v1.14.0 merged, Security's "Audit documentation site" step failed on main (run 36787938895). Four advisories published today hit the docs site's dev-only serve tool:

Advisory	Package	Path	Patched
GHSA-6j4f-fj2g-mc7p (high)	brace-expansion	serve > serve-handler > minimatch	>=5.0.10
GHSA-qhr7-859c-m2p7 (high)	brace-expansion	same	>=5.0.11
GHSA-q2hr-2g5m-vwhr (moderate)	brace-expansion	same	>=5.0.12
GHSA-hrr3-gc8f-f4qj (moderate)	fast-uri	serve > ajv	>=3.1.8

The published CLI is not affected: the root package already resolves brace-expansion 5.0.12, and pnpm audit at the root reports no vulnerabilities.

How it was fixed: raised the site's existing pins in website/pnpm-workspace.yaml (the only place its overrides live) to brace-expansion@<5.0.12: '>=5.0.12 <6' and fast-uri@<3.1.8: ^3.1.8, then regenerated website/pnpm-lock.yaml with pnpm 10.34.5. The root lockfile is untouched, so the Nix flake hash does not change.

Proof:

• Before: pnpm audit --dir website → 4 vulnerabilities (2 high, 2 moderate). After: no known vulnerabilities.
• pnpm install --frozen-lockfile and pnpm build in website/ succeed, and serve out serves the built site (HTTP 200).
• The lockfile's overrides: block keeps every existing pin (postcss, sharp, nanoid).

Notes: docs-site tooling only, so no changeset. This also supersedes the failed Dependabot update job for brace-expansion in /website.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated version requirements for two underlying packages, so installations resolve to newer versions while remaining within the same major-version ranges.
  • Added notes describing the relevant security advisories and development-only dependency paths.

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	a650a58
Status:	✅  Deploy successful!
Preview URL:	https://cd408e04.openspec-docs.pages.dev
Branch Preview URL:	https://fix-website-brace-expansion.openspec-docs.pages.dev

View logs

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: Fission-AI/OpenSpec/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 900dfe62-881b-408a-862e-cf0a82076dd0

📥 Commits

Reviewing files that changed from the base of the PR and between 94ca9c1 and a650a58.

⛔ Files ignored due to path filters (1)

• website/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• website/pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The workspace updates the version ranges for the brace-expansion and fast-uri overrides. It also adds comments about advisories and development-only dependency paths.

Changes

Dependency overrides

Layer / File(s)	Summary
Update dependency override ranges website/pnpm-workspace.yaml	The brace-expansion override now replaces versions below 5.0.12 with >=5.0.12 <6. The fast-uri override now replaces versions below 3.1.8 with ^3.1.8. Comments identify advisories and development-only dependency paths.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: alfred-openspec

Merge Risk: ⚪ Minimal · up to a650a

No concrete merge-blocking risk is established; the website’s reachable dependency paths use the reported fixed versions.

Architecture Summary

Architecture risk: 🔵 Low · up to a650a

The change affects 1 system.

Changed systems: website

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — website (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in website/pnpm-workspace.yaml: The brace-expansion override threshold and replacement range changed from <=5.0.8 and >=5.0.9 <6 to <5.0.12 and >=5.0.12 <6; the fast-uri threshold and replacement changed from <3.1.6 and ^3.1.6 to <3.1.8 and ^3.1.8. Comments identifying advisories and development-only dependency paths were added.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating website dependency pins for brace-expansion and fast-uri to address new security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openspec-cloud]

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at a650a58 (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.