Distillation

<observations> Date: June 23, 2026

🔴 (09:41) User switched to new branch 'security/deps-resolve-open-alerts' off origin/main (no longer on security/deps-esbuild-0.28.1)
🟡 (09:35) Working tree state on security/deps-esbuild-0.28.1 before branch switch: modified AGENTS.md, untracked .lore.md, untracked .opencode/, untracked packages/website/content.config.ts; stash@{0} WIP on fix/security-dependabot-alerts (c0403b48), stash@{1} WIP on fix/cap-esbuild-override (2ca6dc77)
🟡 (09:35) origin/main advanced to 6a0022ef (was dfd2049a); PR #1323 merged 2026-06-16 with esbuild fix; Dependabot #279 last scanned 2026-06-12 so will auto-close without action
🟡 (09:35) origin/main pnpm overrides snapshot (relevant): "vite@>=7.0.0 <7.3.2": ">=7.3.2", "tar": ">=7.5.11", "form-data": ">=4.0.4", "esbuild": ">=0.28.1"
🟡 (09:36) Full advisory details confirmed for 7 actionable alerts:
- #287 tar <=7.5.15 → patched 7.5.16 (PAX size override file smuggling, medium)
- #286 form-data >=4.0.0 <4.0.6 → patched 4.0.6 (CRLF injection, high)
- #285 vite >=7.0.0 <=7.3.4 → patched 7.3.5; root cause: launch-editor <=2.14.0 (NTLMv2 hash disclosure, medium)
- #284 astro <6.4.6 → patched 6.4.6 (XSS via unescaped spread props, medium)
- #283 astro <6.4.6 → patched 6.4.6 (Host header SSRF in prerendered error page fetch, high)
- #282 vite >=7.0.0 <=7.3.4 → patched 7.3.5 (server.fs.deny bypass on Windows, high)
- #281 @opentelemetry/core <2.8.0 → patched 2.8.0 (unbounded memory in W3C Baggage propagation, medium)
- #279/#280 esbuild: already resolved on main (>=0.28.1 override), will auto-close
🟡 (09:36) packages/website/package.json: astro direct dep was "^6.1.10" (resolving 6.3.3); @astrojs/react ^5.0.5, @astrojs/starlight ^0.39.2, @astrojs/vercel ^10.0.7, @sentry/astro catalog:, vite-plugin-inspect ^0.7.42
🟡 (09:37) @opentelemetry/core@2.2.0 pulled transitively via @sentry/node@10.32.1 (in @spotlightjs/spotlight) and @sentry/node@10.29.0 (in @sentry/electron@7.5.0); all otel core instances resolve to single 2.2.0
🟡 (09:39) origin/main lockfile confirmed versions before changes: tar@7.5.11, form-data@4.0.4, vite@7.3.3, vite@6.4.3, @opentelemetry/core@2.2.0, astro@6.3.3, launch-editor@2.14.1 (already patched on main — local stale branch had 2.10.0)
🟡 (09:39) launch-editor: packages/spotlight declares "^2.14.1" specifier; origin/main lockfile already has launch-editor@2.14.1 — no override needed; local stale lock was misleading
🟡 (09:40) Checkout to new branch blocked twice: (1) .lore.md untracked locally but tracked on origin/main — would be overwritten; (2) AGENTS.md modified locally. Resolution: local .lore.md had newer lore content (2 new entries vs main); AGENTS.md local change was identical to origin/main content → discarded with git checkout -- AGENTS.md; .lore.md moved aside temporarily, checkout succeeded, .lore.md restored as tracked modification
🟡 (09:40) Local .lore.md had 2 new entries vs origin/main: (1) lore:019ed0b6-c2c6 — esbuild override cap resolved at 0.28.

Distillation

Observations