monsqlize 3.3.3 → 3.3.4

package/CHANGELOG.md

@@ -1,18 +1,19 @@
 # CHANGELOG
 
-> Summary index — the 3.3.3 versioned details are in [changelogs/v3.3.3.md](./changelogs/v3.3.3.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
-> **Last updated**: 2026-10-23
+> Summary index — the 3.3.4 versioned details are in [changelogs/v3.3.4.md](./changelogs/v3.3.4.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
+> **Last updated**: 2026-10-26
 
 ---
 
 ## Unreleased
 
-The schema-dsl 3.0.5 dependency upgrade is assigned to **3.3.3** ([versioned notes](./changelogs/v3.3.3.md)); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
+The weekly-scan cache-key, health-check and lockfile security fixes are assigned to **3.3.4** ([versioned notes](./changelogs/v3.3.4.md)); the schema-dsl 3.0.5 upgrade is in [3.3.3](./changelogs/v3.3.3.md); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
 
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v3.3.4](./changelogs/v3.3.4.md) | 2026-10-26 | Patch: cached-read keys under autoConvertObjectId, hung health-check pings, lockfile security patches | [View](./changelogs/v3.3.4.md) |
 | [v3.3.3](./changelogs/v3.3.3.md) | 2026-10-23 | Patch: pin schema-dsl 3.0.5 (dependency bug fixes only) | [View](./changelogs/v3.3.3.md) |
 | [v3.3.2](./changelogs/v3.3.2.md) | 2026-10-22 | Patch: BSON/cache identity, Model invalidation, pagination, transaction/sync lifecycle and upgrade safeguards; availability requires registry/tag verification | [View](./changelogs/v3.3.2.md) |
 | [v3.3.1](./changelogs/v3.3.1.md) | 2026-09-23 | Patch: audited Model, count, transaction, cache, sync, pool, Data Task and SSH corrections | [View](./changelogs/v3.3.1.md) |

package/README.md

@@ -14,7 +14,7 @@ Upgrade and security: [Migration Guide](./MIGRATION.md) · [Private Vulnerabilit
 
 The npm `latest` dist-tag and GitHub Pages are the stable channel; `main` may contain the next release. Pages deployment accepts only a versioned Git tag whose package version is already present on npm, so unpublished APIs are not promoted as stable documentation. The Google site ownership verification file is copied separately from the workflow commit, with its source commit and content hash recorded in the deployment summary.
 
-This source tree targets **3.3.3**, a dependency-only patch pinning `schema-dsl@3.0.5` (see the [3.3.3 notes](./changelogs/v3.3.3.md)). The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
+This source tree targets **3.3.4**, a patch fixing cached-read keys under `autoConvertObjectId`, hung health-check pings and lockfile security advisories (see the [3.3.4 notes](./changelogs/v3.3.4.md)); 3.3.3 pinned `schema-dsl@3.0.5`. The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
 
 This development source is pinned to verified registry `schema-dsl@3.0.5`. The v3 package remains subject to the full release gate before an immutable tag and npm publication.
 

package/changelogs/v3.3.4.md

@@ -0,0 +1,21 @@
+# monSQLize v3.3.4
+
+> Release date: 2026-10-26
+> Publication authority: the immutable tag and npm registry. An untagged checkout is a release candidate; the date above does not establish registry availability.
+
+## Highlights
+
+Bug-fix and security patch. Public entry points, signatures, Node.js `>=18`, build formats and package budgets remain unchanged from 3.3.3.
+
+## Fixed
+
+- Key cached `find`, `findOne`, `count` and `distinct` reads by the exact filter sent to MongoDB. With `autoConvertObjectId`, a filter whose `toBSON()` yields a 24-hex string `_id` no longer shares a cache entry with the equivalent `ObjectId` query; plain string filters still convert and share keys as before. Uncached results, invalidation descriptors and public signatures are unchanged.
+- Let a health check whose ping hangs past `timeout` keep counting failures: later checks wait on the same pending ping instead of skipping, so the pool reaches `down` after `retries` timeouts. Still only one ping per pool is in flight, and a late ping result cannot overwrite newer status.
+
+## Security
+
+- Refresh lockfile-only security patches: `fast-uri` 3.1.9 (production, via schema-dsl/ajv; clears 4 GHSA advisories that failed `test:audit`), dev-only `follow-redirects` 1.16.2 and overridden `brace-expansion` 1.1.21/5.0.12. No direct dependency version changes.
+
+## Upgrade and rollback
+
+No migration is required. Cached reads whose filter uses `toBSON()` with `autoConvertObjectId` get a new key and are read once from MongoDB after upgrade; all other cache keys are unchanged. Rollback to 3.3.3 restores the previous behavior and lockfile.

package/dist/cjs/cli/data-task.cjs

@@ -31,7 +31,7 @@ var import_node_url = require("node:url");
 // package.json
 var package_default = {
   name: "monsqlize",
-  version: "3.3.3",
+  version: "3.3.4",
   description: "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
   type: "commonjs",
   main: "./dist/cjs/index.cjs",
@@ -53,6 +53,7 @@ var package_default = {
   },
   files: [
     "changelogs/v3.3.3.md",
+    "changelogs/v3.3.4.md",
     "changelogs/v3.3.2.md",
     "changelogs/v3.3.1.md",
     "changelogs/v3.3.0.md",
@@ -199,12 +200,12 @@ var package_default = {
     ssh2: "1.17.0"
   },
   overrides: {
-    "fast-uri": "^3.1.8",
+    "fast-uri": "^3.1.9",
     "minimatch@3.1.5": {
-      "brace-expansion": "1.1.18"
+      "brace-expansion": "1.1.21"
     },
     "minimatch@10.2.5": {
-      "brace-expansion": "5.0.9"
+      "brace-expansion": "5.0.12"
     }
   }
 };

package/dist/cjs/index.cjs

@@ -8265,18 +8265,26 @@ var HealthChecker = class {
     const status = this._healthStatus.get(poolName);
     if (!status) return;
     const client = this._clients.get(poolName) ?? this._poolManager?._getPool(poolName);
-    if (this._inProgress.get(poolName)?.client === client && this._inProgress.has(poolName)) return;
+    const pending = this._inProgress.get(poolName);
+    if (pending && pending.client === client && pending.awaited) return;
     const epoch = this._epochs.get(poolName);
-    const promise = Promise.resolve().then(() => {
-      if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
-      return this._pingOverride ? this._pingOverride(poolName) : this._pingPool(poolName);
-    });
-    const operation = { client, promise };
-    this._inProgress.set(poolName, operation);
-    const clearPending = () => {
-      if (this._inProgress.get(poolName) === operation) this._inProgress.delete(poolName);
-    };
-    void promise.then(clearPending, clearPending);
+    let operation;
+    if (pending && pending.client === client) {
+      operation = pending;
+    } else {
+      const promise2 = Promise.resolve().then(() => {
+        if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
+        return this._pingOverride ? this._pingOverride(poolName) : this._pingPool(poolName);
+      });
+      operation = { client, promise: promise2, awaited: true };
+      this._inProgress.set(poolName, operation);
+      const clearPending = () => {
+        if (this._inProgress.get(poolName) === operation) this._inProgress.delete(poolName);
+      };
+      void promise2.then(clearPending, clearPending);
+    }
+    operation.awaited = true;
+    const promise = operation.promise;
     let timer;
     let lastError = null;
     try {
@@ -8288,6 +8296,7 @@ var HealthChecker = class {
       lastError = error instanceof Error ? error : new Error(String(error));
     } finally {
       if (timer) clearTimeout(timer);
+      operation.awaited = false;
     }
     if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
     status.lastCheck = /* @__PURE__ */ new Date();
@@ -10745,27 +10754,28 @@ function normalizeFindPageLimit(limit, defaults2) {
   }
   return rawLimit;
 }
-function documentReadKey(operation, collection, defaults2, query, options, field) {
-  const captured = snapshotReadInputs(normalizeQueryForCache(query, defaults2), options, collection.bsonOptions);
+function documentReadKey(operation, collection, defaults2, query, options, field, queryPrepared = false) {
+  const keyQuery = queryPrepared ? query ?? {} : normalizeQueryForCache(query, defaults2);
+  const captured = snapshotReadInputs(keyQuery, options, collection.bsonOptions);
   const keyOptions = buildResultCacheKeyOptions(captured.options, collection.bsonOptions);
   if (operation === "count") delete keyOptions.fieldsAsRaw;
   const body = field === void 0 ? stableCacheKeyString(captured.query, "document") : stableCacheKeyString({ key: field, query: captured.query });
   return `${operation}:${buildCollectionCacheNamespace(collection, defaults2)}:${body}:${stableCacheKeyString(keyOptions)}`;
 }
-function buildFindCacheKey(collection, defaults2 = {}, query, options) {
+function buildFindCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
   return documentReadKey("find", collection, defaults2, query, normalizeFindProjectionOptions({
     limit: defaults2.findLimit,
     ...options ?? {}
-  }));
+  }), void 0, queryPrepared);
 }
-function buildFindOneCacheKey(collection, defaults2 = {}, query, options) {
-  return documentReadKey("findOne", collection, defaults2, query, normalizeFindProjectionOptions(options));
+function buildFindOneCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
+  return documentReadKey("findOne", collection, defaults2, query, normalizeFindProjectionOptions(options), void 0, queryPrepared);
 }
-function buildCountCacheKey(collection, defaults2 = {}, query, options) {
-  return documentReadKey("count", collection, defaults2, query, options);
+function buildCountCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
+  return documentReadKey("count", collection, defaults2, query, options, void 0, queryPrepared);
 }
-function buildDistinctCacheKey(collection, defaults2 = {}, field, query, options) {
-  return documentReadKey("distinct", collection, defaults2, query, options, field);
+function buildDistinctCacheKey(collection, defaults2 = {}, field, query, options, queryPrepared = false) {
+  return documentReadKey("distinct", collection, defaults2, query, options, field, queryPrepared);
 }
 function buildPreparedAggregateCacheKey(collection, defaults2 = {}, pipeline = [], options) {
   const namespace = buildCollectionCacheNamespace(collection, defaults2);
@@ -11777,7 +11787,7 @@ var FindChain = class {
     const cacheTTL = typeof this.options.cache === "number" ? this.options.cache : 0;
     const executeOptions = prepared.options;
     if (cacheTTL > 0 && this.queryCache && canCacheBsonResult(executeOptions) && !hasSessionOption(executeOptions) && !await isCollectionCacheBarrierActive(this.queryCache, this.collection, this.defaults)) {
-      const cacheKey = buildFindCacheKey(this.collection, this.defaults, prepared.query, executeOptions);
+      const cacheKey = buildFindCacheKey(this.collection, this.defaults, prepared.query, executeOptions, true);
       const result = await readThroughCache(this.queryCache, cacheKey, cacheTTL, () => this.runToArray(prepared));
       return this.wrapResult("find", startTs, result);
     }
@@ -13619,7 +13629,7 @@ var MongoCollectionAccessor = class {
     const { query: normalizedQuery, options: driverOptions } = snapshotReadInputs(this._cvFilter(query), normalizeFindProjectionOptions(rawOptions), this.collectionRef.bsonOptions);
     const cacheTTL = rawOptions.explain ? 0 : typeof rawOptions.cache === "number" ? rawOptions.cache : 0;
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonResult(driverOptions) && !hasSessionOption(driverOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildFindOneCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, driverOptions);
+      const cacheKey = buildFindOneCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, driverOptions, true);
       const result2 = await readThroughCache(this.management.queryCache, cacheKey, cacheTTL, () => findOneDocument(this.collectionRef, normalizedQuery, driverOptions));
       return wrapQueryResultWithMeta(this.collectionRef, this.management.defaults, "findOne", rawOptions, startTs, result2);
     }
@@ -13676,7 +13686,7 @@ var MongoCollectionAccessor = class {
     );
     const countQueue = this.management.defaults?.countQueue;
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonCount(keyOptions) && !hasSessionOption(keyOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildCountCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, keyOptions);
+      const cacheKey = buildCountCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, keyOptions, true);
       const result = await readThroughCache(
         this.management.queryCache,
         cacheKey,
@@ -13769,7 +13779,7 @@ var MongoCollectionAccessor = class {
       driverOptions
     );
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonResult(driverOptions) && !hasSessionOption(driverOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildDistinctCacheKey(this.collectionRef, this.management.defaults, key, normalizedQuery, driverOptions);
+      const cacheKey = buildDistinctCacheKey(this.collectionRef, this.management.defaults, key, normalizedQuery, driverOptions, true);
       const result2 = await readThroughCache(this.management.queryCache, cacheKey, cacheTTL, executeDistinct);
       return wrapQueryResultWithMeta(this.collectionRef, this.management.defaults, "distinct", rawOptions, startTs, result2);
     }

package/dist/esm/index.mjs

@@ -8248,18 +8248,26 @@ var HealthChecker = class {
     const status = this._healthStatus.get(poolName);
     if (!status) return;
     const client = this._clients.get(poolName) ?? this._poolManager?._getPool(poolName);
-    if (this._inProgress.get(poolName)?.client === client && this._inProgress.has(poolName)) return;
+    const pending = this._inProgress.get(poolName);
+    if (pending && pending.client === client && pending.awaited) return;
     const epoch = this._epochs.get(poolName);
-    const promise = Promise.resolve().then(() => {
-      if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
-      return this._pingOverride ? this._pingOverride(poolName) : this._pingPool(poolName);
-    });
-    const operation = { client, promise };
-    this._inProgress.set(poolName, operation);
-    const clearPending = () => {
-      if (this._inProgress.get(poolName) === operation) this._inProgress.delete(poolName);
-    };
-    void promise.then(clearPending, clearPending);
+    let operation;
+    if (pending && pending.client === client) {
+      operation = pending;
+    } else {
+      const promise2 = Promise.resolve().then(() => {
+        if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
+        return this._pingOverride ? this._pingOverride(poolName) : this._pingPool(poolName);
+      });
+      operation = { client, promise: promise2, awaited: true };
+      this._inProgress.set(poolName, operation);
+      const clearPending = () => {
+        if (this._inProgress.get(poolName) === operation) this._inProgress.delete(poolName);
+      };
+      void promise2.then(clearPending, clearPending);
+    }
+    operation.awaited = true;
+    const promise = operation.promise;
     let timer;
     let lastError = null;
     try {
@@ -8271,6 +8279,7 @@ var HealthChecker = class {
       lastError = error instanceof Error ? error : new Error(String(error));
     } finally {
       if (timer) clearTimeout(timer);
+      operation.awaited = false;
     }
     if (this._epochs.get(poolName) !== epoch || this._healthStatus.get(poolName) !== status) return;
     status.lastCheck = /* @__PURE__ */ new Date();
@@ -10728,27 +10737,28 @@ function normalizeFindPageLimit(limit, defaults2) {
   }
   return rawLimit;
 }
-function documentReadKey(operation, collection, defaults2, query, options, field) {
-  const captured = snapshotReadInputs(normalizeQueryForCache(query, defaults2), options, collection.bsonOptions);
+function documentReadKey(operation, collection, defaults2, query, options, field, queryPrepared = false) {
+  const keyQuery = queryPrepared ? query ?? {} : normalizeQueryForCache(query, defaults2);
+  const captured = snapshotReadInputs(keyQuery, options, collection.bsonOptions);
   const keyOptions = buildResultCacheKeyOptions(captured.options, collection.bsonOptions);
   if (operation === "count") delete keyOptions.fieldsAsRaw;
   const body = field === void 0 ? stableCacheKeyString(captured.query, "document") : stableCacheKeyString({ key: field, query: captured.query });
   return `${operation}:${buildCollectionCacheNamespace(collection, defaults2)}:${body}:${stableCacheKeyString(keyOptions)}`;
 }
-function buildFindCacheKey(collection, defaults2 = {}, query, options) {
+function buildFindCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
   return documentReadKey("find", collection, defaults2, query, normalizeFindProjectionOptions({
     limit: defaults2.findLimit,
     ...options ?? {}
-  }));
+  }), void 0, queryPrepared);
 }
-function buildFindOneCacheKey(collection, defaults2 = {}, query, options) {
-  return documentReadKey("findOne", collection, defaults2, query, normalizeFindProjectionOptions(options));
+function buildFindOneCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
+  return documentReadKey("findOne", collection, defaults2, query, normalizeFindProjectionOptions(options), void 0, queryPrepared);
 }
-function buildCountCacheKey(collection, defaults2 = {}, query, options) {
-  return documentReadKey("count", collection, defaults2, query, options);
+function buildCountCacheKey(collection, defaults2 = {}, query, options, queryPrepared = false) {
+  return documentReadKey("count", collection, defaults2, query, options, void 0, queryPrepared);
 }
-function buildDistinctCacheKey(collection, defaults2 = {}, field, query, options) {
-  return documentReadKey("distinct", collection, defaults2, query, options, field);
+function buildDistinctCacheKey(collection, defaults2 = {}, field, query, options, queryPrepared = false) {
+  return documentReadKey("distinct", collection, defaults2, query, options, field, queryPrepared);
 }
 function buildPreparedAggregateCacheKey(collection, defaults2 = {}, pipeline = [], options) {
   const namespace = buildCollectionCacheNamespace(collection, defaults2);
@@ -11760,7 +11770,7 @@ var FindChain = class {
     const cacheTTL = typeof this.options.cache === "number" ? this.options.cache : 0;
     const executeOptions = prepared.options;
     if (cacheTTL > 0 && this.queryCache && canCacheBsonResult(executeOptions) && !hasSessionOption(executeOptions) && !await isCollectionCacheBarrierActive(this.queryCache, this.collection, this.defaults)) {
-      const cacheKey = buildFindCacheKey(this.collection, this.defaults, prepared.query, executeOptions);
+      const cacheKey = buildFindCacheKey(this.collection, this.defaults, prepared.query, executeOptions, true);
       const result = await readThroughCache(this.queryCache, cacheKey, cacheTTL, () => this.runToArray(prepared));
       return this.wrapResult("find", startTs, result);
     }
@@ -13602,7 +13612,7 @@ var MongoCollectionAccessor = class {
     const { query: normalizedQuery, options: driverOptions } = snapshotReadInputs(this._cvFilter(query), normalizeFindProjectionOptions(rawOptions), this.collectionRef.bsonOptions);
     const cacheTTL = rawOptions.explain ? 0 : typeof rawOptions.cache === "number" ? rawOptions.cache : 0;
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonResult(driverOptions) && !hasSessionOption(driverOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildFindOneCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, driverOptions);
+      const cacheKey = buildFindOneCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, driverOptions, true);
       const result2 = await readThroughCache(this.management.queryCache, cacheKey, cacheTTL, () => findOneDocument(this.collectionRef, normalizedQuery, driverOptions));
       return wrapQueryResultWithMeta(this.collectionRef, this.management.defaults, "findOne", rawOptions, startTs, result2);
     }
@@ -13659,7 +13669,7 @@ var MongoCollectionAccessor = class {
     );
     const countQueue = this.management.defaults?.countQueue;
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonCount(keyOptions) && !hasSessionOption(keyOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildCountCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, keyOptions);
+      const cacheKey = buildCountCacheKey(this.collectionRef, this.management.defaults, normalizedQuery, keyOptions, true);
       const result = await readThroughCache(
         this.management.queryCache,
         cacheKey,
@@ -13752,7 +13762,7 @@ var MongoCollectionAccessor = class {
       driverOptions
     );
     if (cacheTTL > 0 && this.management.queryCache && canCacheBsonResult(driverOptions) && !hasSessionOption(driverOptions) && !await isCollectionCacheBarrierActive(this.management.queryCache, this.collectionRef, this.management.defaults)) {
-      const cacheKey = buildDistinctCacheKey(this.collectionRef, this.management.defaults, key, normalizedQuery, driverOptions);
+      const cacheKey = buildDistinctCacheKey(this.collectionRef, this.management.defaults, key, normalizedQuery, driverOptions, true);
       const result2 = await readThroughCache(this.management.queryCache, cacheKey, cacheTTL, executeDistinct);
       return wrapQueryResultWithMeta(this.collectionRef, this.management.defaults, "distinct", rawOptions, startTs, result2);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "monsqlize",
-    "version": "3.3.3",
+    "version": "3.3.4",
     "description": "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
     "type": "commonjs",
     "main": "./dist/cjs/index.cjs",
@@ -22,6 +22,7 @@
     },
     "files": [
         "changelogs/v3.3.3.md",
+        "changelogs/v3.3.4.md",
         "changelogs/v3.3.2.md",
         "changelogs/v3.3.1.md",
         "changelogs/v3.3.0.md",
@@ -168,12 +169,12 @@
         "ssh2": "1.17.0"
     },
     "overrides": {
-        "fast-uri": "^3.1.8",
+        "fast-uri": "^3.1.9",
         "minimatch@3.1.5": {
-            "brace-expansion": "1.1.18"
+            "brace-expansion": "1.1.21"
         },
         "minimatch@10.2.5": {
-            "brace-expansion": "5.0.9"
+            "brace-expansion": "5.0.12"
         }
     }
 }