Automatic Sync: Merge changes from stable/ballerina to main

common/autoinstallers/rush-plugins/package.json

@@ -8,7 +8,7 @@
       "fast-xml-builder": "1.1.7",
       "minimatch": "3.1.5",
       "brace-expansion": "1.1.13",
-      "undici": "6.24.0"
+      "undici": "6.27.0"
     }
   },
   "dependencies": {

common/config/rush/.pnpmfile.cjs

@@ -17,6 +17,7 @@ module.exports = {
     readPackage(pkg, context) {
       function applyOverrides(deps) {
         if (!deps) return;
+        if (deps['@nevware21/ts-utils']) deps['@nevware21/ts-utils'] = '0.14.0';
         if (deps['http-proxy']) deps['http-proxy'] = '1.18.1';
         if (deps['prismjs']) deps['prismjs'] = '1.30.0';
         if (deps['xmldom']) deps['xmldom'] = 'npm:@xmldom/xmldom@0.8.10';
@@ -31,11 +32,12 @@ module.exports = {
         if (deps['esbuild']) deps['esbuild'] = '0.25.12';
         if (deps['lodash']) deps['lodash'] = '4.18.0';
         if (deps['qs']) deps['qs'] = '6.15.2';
-        if (deps['hono']) deps['hono'] = '4.12.18';
+        if (deps['hono']) deps['hono'] = '4.12.21';
+        if (deps['shell-quote']) deps['shell-quote'] = '1.8.4';
         if (deps['@hono/node-server']) deps['@hono/node-server'] = '1.19.13';
         if (deps['@tootallnate/once']) deps['@tootallnate/once'] = '3.0.1';
         if (deps['dompurify']) deps['dompurify'] = '3.4.0';
-        if (deps['axios']) deps['axios'] = '1.15.2';
+        if (deps['axios']) deps['axios'] = '1.16.0';
         if (deps['ip-address']) deps['ip-address'] = '10.1.1';
         if (deps['follow-redirects']) deps['follow-redirects'] = '1.16.0';
         if (deps['express-rate-limit']) deps['express-rate-limit'] = '8.2.2';
@@ -48,15 +50,24 @@ module.exports = {
         if (deps['tmp']) deps['tmp'] = '0.2.6';
         if (deps['undici']) deps['undici'] = '7.24.0';
         if (deps['@nevware21/ts-utils']) deps['@nevware21/ts-utils'] = '0.14.0'; // security fix: CVE-2026-46681 (prototype pollution)
+        if (deps['@ai-sdk/provider-utils']) {
+          const currentVersion = deps['@ai-sdk/provider-utils'];
+          // security mitigation: CVE-2026-8769 (uncontrolled resource consumption) - no fixed
+          // version published yet, pin to the latest 3.x patch
+          if (currentVersion.startsWith('^3') || currentVersion.startsWith('3')) {
+            deps['@ai-sdk/provider-utils'] = '3.0.25';
+          }
+        }
         if (deps['protobufjs']) {
           const currentVersion = deps['protobufjs'];
           if (currentVersion.startsWith('^8') || currentVersion.startsWith('8')) {
-            deps['protobufjs'] = '8.2.0'; // security fix: CVE-2026-45740 (DoS via recursive JSON descriptor expansion)
+            deps['protobufjs'] = '8.2.0';
           } else {
-            deps['protobufjs'] = '7.5.8'; // security fix: CVE-2026-45740 (DoS via recursive JSON descriptor expansion)
+            deps['protobufjs'] = '7.5.8';
           }
         }
         if (deps['vite']) deps['vite'] = '6.0.14';
+        if (deps['webpack-dev-server']) deps['webpack-dev-server'] = '5.2.4';
         if (deps['yauzl']) deps['yauzl'] = '3.2.1';
         if (deps['bn.js']) {
           deps['bn.js'] = deps['bn.js'].startsWith('^5') ? '5.2.3' : '4.12.3';
@@ -96,7 +107,7 @@ module.exports = {
           } else if (currentVersion.startsWith('^3') || currentVersion.startsWith('3')) {
             newVersion = '3.0.2';
           } else if (currentVersion.startsWith('^5') || currentVersion.startsWith('5')) {
-            newVersion = '5.0.5';
+            newVersion = '5.0.6';
           } else {
             context.log(`Unexpected brace-expansion version: ${currentVersion}`);
             newVersion = currentVersion;

common/config/rush/pnpm-config.json

@@ -90,7 +90,20 @@
      */
     "globalOverrides": {
       "lodash": ">=4.18.0",
-      "brace-expansion@>=5.0.0 <6": "5.0.6"
+      "brace-expansion@>=5.0.0 <6": "5.0.6",
+      "axios": ">=1.16.0",
+      "hono": ">=4.12.21",
+      "shell-quote": ">=1.8.4",
+      "@babel/core": ">=7.29.6",
+      "dompurify": ">=3.4.9",
+      "form-data": ">=4.0.6",
+      "js-yaml": ">=4.2.0",
+      "markdown-it": ">=14.2.0",
+      "protobufjs": ">=7.6.3 <8",
+      "tmp": ">=0.2.7",
+      "webpack-dev-server": ">=5.2.5",
+      "undici": ">=7.28.0",
+      "http-proxy-middleware": ">=3.0.6"
     },
 
     /**