From 99787832be6c682dd8e47e334744885de78a5a18 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 12 Aug 2026 03:32:30 +0000
Subject: [PATCH] chore(deps): update dependency js-sha256 to v1

---
 pnpm-lock.yaml      | 12 +++++++-----
 pnpm-workspace.yaml |  7 +------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 21f69f31e7..c2cf2dfcd8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,7 +9,7 @@ overrides:
   isolated-vm: file:./stubs/empty-stub
   onnxruntime-node: file:./stubs/empty-stub
   elliptic: ^6.6.1
-  js-sha256: ^0.11.1
+  js-sha256: ^1.0.0
   xlsx: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
 
 patchedDependencies:
@@ -6041,6 +6041,7 @@ packages:
   cron-parser@4.9.0:
     resolution: {integrity: sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q==}
     engines: {node: '>=12.0.0'}
+    deprecated: v4 is no longer maintained, upgrade to v5
 
   cron-validator@1.4.0:
     resolution: {integrity: sha512-wGcJ9FCy65iaU6egSH8b5dZYJF7GU/3Jh06wzaT9lsa5dbqExjljmu+0cJ8cpKn+vUyZa/EM4WAxeLR6SypJXw==}
@@ -6068,6 +6069,7 @@ packages:
 
   crypto-js@4.2.0:
     resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}
+    deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained.
 
   crypto-random-string@2.0.0:
     resolution: {integrity: sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==}
@@ -8038,8 +8040,8 @@ packages:
   js-cookie@3.0.8:
     resolution: {integrity: sha512-yeJd4aNAdYZQjaon2bpD/Gb0B/omw7HQOsynXXcOiWVCacbBcPlgn8S/d1X6blFSaHao7ozqtW7NZW19xpCtIw==}
 
-  js-sha256@0.11.1:
-    resolution: {integrity: sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==}
+  js-sha256@1.0.0:
+    resolution: {integrity: sha512-Bqxf6ENUzYIMzuELCmRNrJOVbjKH1oMgbfYJBKVr/W1Xf9fazpahqCbb24v1pR7XV1isuqhM+w9KWpK7zCyUQw==}
 
   js-string-escape@1.0.1:
     resolution: {integrity: sha512-Smw4xcfIQ5LVjAOuJCvN/zIodzA/BBSsluuoSykP+lUvScIi4U6RJLfwHet5cxFnCswUjISV8oAXaqaJDY3chg==}
@@ -13190,7 +13192,7 @@ snapshots:
 
   '@it-tools/bip39@0.0.4':
     dependencies:
-      js-sha256: 0.11.1
+      js-sha256: 1.0.0
       nanoid: 3.3.15
 
   '@it-tools/oggen@1.3.0': {}
@@ -18848,7 +18850,7 @@ snapshots:
 
   js-cookie@3.0.8: {}
 
-  js-sha256@0.11.1: {}
+  js-sha256@1.0.0: {}
 
   js-string-escape@1.0.1: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ca12e789e6..917823515f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,8 +1,3 @@
-# The xlsx override below intentionally points the whole graph (including
-# wsemi's transitive xlsx) at the SheetJS CDN tarball, because the npm
-# registry version is stale (0.18.5) and carries known vulnerabilities.
-# pnpm 11 blocks URL tarballs in subdependencies by default and has no
-# per-package exception, so this protection must be disabled repo-wide.
 blockExoticSubdeps: false
 
 overrides:
@@ -15,7 +10,7 @@ overrides:
   elliptic: ^6.6.1
   # @it-tools/bip39 pins ^0.9.0, whose Node fallback uses eval("require('crypto')")
   # and triggers rolldown EVAL build warnings; 0.11.x dropped the eval.
-  js-sha256: ^0.11.1
+  js-sha256: ^1.0.0
   xlsx: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
 
 patchedDependencies: