chore(security): patch 8 Dependabot alerts

package.json

@@ -24,7 +24,7 @@
     "husky": "^8.0.3",
     "jest": "^29.3.1",
     "jest-extended": "^3.2.3",
-    "lerna": "^8.2.3",
+    "lerna": "^9.0.7",
     "markdown-link-check": "^3.10.3",
     "nock": "^13.3.0",
     "prettier": "^2.8.2",
@@ -56,6 +56,7 @@
   "resolutions": {
     "tar": ">=7.5.16",
     "lerna/**/glob": ">=10.5.0",
+    "**/lerna/js-yaml": "^4.2.0",
     "semantic-release": "^25.0.0",
     "qs": ">=6.15.2",
     "langsmith": "^0.6.0",
@@ -64,18 +65,12 @@
     "tmp": ">=0.2.6",
     "**/express-rate-limit/ip-address": "^10.1.1",
     "**/@aws-sdk/xml-builder/fast-xml-parser": "^5.7.0",
-    "**/@modelcontextprotocol/sdk/hono": "^4.12.25",
     "**/@fastify/ajv-compiler/fast-uri": "^3.1.2",
     "**/fast-json-stringify/fast-uri": "^3.1.2",
-    "form-data": ">=4.0.6",
-    "@babel/core": "^7.29.6",
     "**/node-gyp/undici": "^6.27.0",
     "**/@actions/http-client/undici": "^6.27.0",
     "**/@semantic-release/github/undici": "^7.28.0",
-    "**/@nestjs/platform-express/multer": "^2.2.0",
-    "**/typedoc/markdown-it": "^14.2.0",
     "**/subscriptions-transport-ws/ws": "^7.5.11",
-    "**/tsx/esbuild": "^0.28.1",
     "**/concurrently/shell-quote": "^1.8.4",
     "**/forest-cli/joi": "^17.13.4"
   }

packages/_example/package.json

@@ -13,10 +13,10 @@
     "@forestadmin/datasource-sql": "*",
     "@forestadmin/datasource-toolkit": "*",
     "@koa/router": "^13.1.0",
-    "@nestjs/common": "^10.4.16",
-    "@nestjs/core": "^10.4.16",
-    "@nestjs/platform-express": "^10.4.16",
-    "@nestjs/platform-fastify": "^10.4.16",
+    "@nestjs/common": "^11.1.24",
+    "@nestjs/core": "^11.1.24",
+    "@nestjs/platform-express": "^11.1.24",
+    "@nestjs/platform-fastify": "^11.1.24",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
     "fastify": "^3.29.0",

packages/agent/package.json

@@ -49,10 +49,10 @@
     "@fastify/express": "^1.1.0",
     "@forestadmin/datasource-sql": "1.17.10",
     "@forestadmin/workflow-executor": "1.17.2",
-    "@nestjs/common": "^10.4.16",
-    "@nestjs/core": "^10.4.16",
-    "@nestjs/platform-express": "^10.4.16",
-    "@nestjs/platform-fastify": "^10.4.16",
+    "@nestjs/common": "^11.1.24",
+    "@nestjs/core": "^11.1.24",
+    "@nestjs/platform-express": "^11.1.24",
+    "@nestjs/platform-fastify": "^11.1.24",
     "@shopify/jest-koa-mocks": "^3.1.0",
     "sequelize": "^6.37.8",
     "sqlite3": "^5.1.7",

packages/workflow-executor/docker/build-deps-manifest.js

@@ -32,6 +32,14 @@ const OTEL_DEPENDENCIES = {
   '@opentelemetry/exporter-trace-otlp-http': '0.219.0',
 };
 
+// Security pins for transitive deps whose parents never ship a patched range.
+// sequelize@6 pins uuid ^8.3.2 (GHSA-w5hq-g745-h8pq, patched in 11.1.1); the
+// monorepo root already forces uuid ^11.1.1 under sequelize, so this mirrors a
+// combination CI exercises.
+const RESOLUTIONS = {
+  '**/sequelize/uuid': '^11.1.1',
+};
+
 function generate(packagesDir, outFile) {
   // Collect every declared range per external dependency, tracking which packages
   // ask for it — a flat install can hold only one version, so we must resolve
@@ -90,6 +98,7 @@ function generate(packagesDir, outFile) {
   if (packageManager) manifest.packageManager = packageManager;
 
   manifest.dependencies = sorted;
+  manifest.resolutions = RESOLUTIONS;
 
   fs.writeFileSync(outFile, `${JSON.stringify(manifest, null, 2)}\n`);
 }