{"content":"Development journal for commit 2b793d95 (fix(dsh-plugin): pin audited transitive deps via pnpm overrides (zod, undici, fast-uri, fflate, http-cache-semantics)).\n\nAfter Dependency graph was enabled, Dependabot opened security-update jobs for /dsh-plugin and reported every one as security_update_not_possible: the vulnerable packages are transitive dependencies of DSH kernel packages that pin older exact versions (dsh-typert-registry/dsh-user-questions/dsh-workspace pin zod 4.4.3, dsh-http-proxy pins undici 8.11.2, libreoffice-kit pins fflate 0.8.2), so no lockfile-only update can reach the patched releases, and a plain pnpm update cascades into kernel bumps. Resolved the same way the repository root handles audits: dsh-plugin/pnpm-workspace.yaml now carries overrides for zod 4.6.7 (GHSA-mrhx-c7xc-m3w5, the only one in the plugin's production tree; the same kernel release already runs dsh-llm on zod 4.6.x), undici 8.12.3, fast-uri 3.1.9, fflate 0.8.3 and http-cache-semantics 4.3.0 (all four dev-only paths through dsh-web-app). The lockfile diff touches only those five packages — no DSH kernel package version moves. Verification: dsh-plugin build + typecheck clean, full suite 913/913, pnpm audit --audit-level=low reports no known vulnerabilities; the CI matrix (dsh 0.1.7-rc.2 / 0.2.0-rc.2 / 0.2.1-rc.2) reinstalls with these overrides and typechecks each kernel.\n\nVerification:\nexport PATH=$HOME/.nvm/versions/node/v24.13.1/bin:$PATH && cd dsh-plugin && pnpm audit --audit-level=low && node --test --test-concurrency=1 tests/plugin-shape.test.mjs tests/metaweb-tools.test.mjs tests/group-chat-tools.test.mjs tests/longtask-tools.test.mjs tests/cerebellum-core.test.mjs\n\nFiles:\ndsh-plugin/pnpm-lock.yaml\ndsh-plugin/pnpm-workspace.yaml","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}