From 7f89026049709b0629088efe271018af04f19cf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valent=C3=ADn=20Quiroz=20de=20la=20Sierra?=
 <85706426+vqsierra@users.noreply.github.com>
Date: Sat, 14 Nov 2026 01:43:37 -0500
Subject: [PATCH 1/2] Override typescript-estree's minimatch to 11.0.8
 (GHSA-g3hv-75wg-m249)

typescript-eslint 8.72.2 still asks for minimatch ^10.2.2, which is in the
vulnerable range (>=7.0.0 <11.0.1). Lint only; the minimatch 3.x copies are
outside the range. Remove the override once typescript-estree allows 11.
---
 app/package-lock.json | 18 +++++++++++++-----
 app/package.json      |  3 +++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/app/package-lock.json b/app/package-lock.json
index 847ebbd..534313a 100644
--- a/app/package-lock.json
+++ b/app/package-lock.json
@@ -1754,6 +1754,13 @@
         "url": "https://opencollective.com/libvips"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@jetbrains/icons": {
       "version": "5.24.0",
       "resolved": "https://registry.npmjs.org/@jetbrains/icons/-/icons-5.24.0.tgz",
@@ -2920,16 +2927,17 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.8.tgz",
+      "integrity": "sha512-nFQuYSTVrGvysVBps5Ih+0BdnYFN/Cj3C816r6+p7yK+FHrVLGE4O4N9AFwykrlNlvM2HYt+Rad1Uiro6h88Ig==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.1.0",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
diff --git a/app/package.json b/app/package.json
index f66b33e..dc2b416 100644
--- a/app/package.json
+++ b/app/package.json
@@ -58,6 +58,9 @@
   "overrides": {
     "miniflare": {
       "sharp": "0.35.5"
+    },
+    "@typescript-eslint/typescript-estree": {
+      "minimatch": "11.0.8"
     }
   }
 }

From 04b3d4a17d4bba5f22be3694952dcddc67b999c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valent=C3=ADn=20Quiroz=20de=20la=20Sierra?=
 <85706426+vqsierra@users.noreply.github.com>
Date: Sat, 14 Nov 2026 01:45:14 -0500
Subject: [PATCH 2/2] Override satori's fflate to 0.7.5 (GHSA-px8p-9vwx-vf98)

vinext 1.4.5 pins @vercel/og 1.0.3, which pins satori 0.33.5 and fflate 0.7.3.
The latest satori still pins 0.7.3. 0.7.5 is the patched release in the same
minor line. mPile never generates OG images, and fflate isn't in the build.
npm audit now finds 0 vulnerabilities.
---
 app/package-lock.json | 6 +++---
 app/package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/app/package-lock.json b/app/package-lock.json
index 534313a..480f120 100644
--- a/app/package-lock.json
+++ b/app/package-lock.json
@@ -5400,9 +5400,9 @@
       }
     },
     "node_modules/fflate": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.7.3.tgz",
-      "integrity": "sha512-0Zz1jOzJWERhyhsimS54VTqOteCNwRtIlh8isdL0AXLo0g7xNTfTL7oWrkmCnPhZGocKIkWHBistBrrpoNH3aw==",
+      "version": "0.7.5",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.7.5.tgz",
+      "integrity": "sha512-QieYf//cis6ywHNi5qW1+PXPQ4bC+XVJAtS4AXIML8P76GroEiOxm/oQtn1f02UkJY1+KsXMJcC+R2v/Eg4G3g==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/app/package.json b/app/package.json
index dc2b416..97f5e6c 100644
--- a/app/package.json
+++ b/app/package.json
@@ -61,6 +61,9 @@
     },
     "@typescript-eslint/typescript-estree": {
       "minimatch": "11.0.8"
+    },
+    "satori": {
+      "fflate": "0.7.5"
     }
   }
 }