fix(deps): bump non-breaking dependencies and fix security issues

[g-ongenae]

Description

• Update deps within semver ranges (pino 9.14, typescript 5.9, sinon 21.1, eslint 8.57.1, lint-staged 17.3, semantic-release 24.2.9, uuid 14.0.2, @commitlint/config-conventional 21.2.2)
• Add scoped overrides for vulnerable transitive deps: minimatch ^9.0.7 (ReDoS, GHSA-3ppc/7r86/23c5) and uuid ^11.1.1 under gaxios/google-gax/teeny-request (GHSA-w5hq-g745-h8pq); the uuid override can be dropped once @google-cloud/pubsub@6 lands
• Import pino Logger/LoggerOptions types directly (namespace types removed in pino 9.14)
• Align @types/sinon with the sinon 21 runtime; drop @types/uuid (uuid 14 ships its own types)

Remaining audit findings all trace to the npm CLI bundled in the semantic-release toolchain (release-time only); fixed by the semantic-release@25 major upgrade.

Motivation and Context

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​8.57.0 ⏵ 8.57.1
	@​types/​sinon@​17.0.4 ⏵ 21.0.1
	sinon@​21.0.3 ⏵ 21.1.2	+1		+1
	uuid@​14.0.1 ⏵ 14.0.2			+1
	typescript@​5.8.3 ⏵ 5.9.3	+1		+1
	pino@​9.7.0 ⏵ 9.14.0
	@​commitlint/​config-conventional@​21.2.0 ⏵ 21.2.2
	lint-staged@​17.1.1 ⏵ 17.3.0	+1			+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → npm/typescript@5.9.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR updates dependency versions and adjusts PubSub wrapper typings to accommodate updated pino type exports, while adding npm overrides intended to remediate vulnerable transitive dependencies.

Changes:

• Updated pino type imports/usages (LoggerOptions, Logger) to match the newer pino type surface.
• Bumped several dev/runtime dependencies within semver ranges.
• Added npm overrides for minimatch and uuid in an attempt to address transitive vulnerability advisories.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/GoogleCloudPubSub/lib.ts	Updates pinoOptions typing to use LoggerOptions directly.
src/GoogleCloudPubSub/GoogleCloudPubSub.ts	Updates logger typing to use Logger from pino.
package.json	Dependency bumps plus new overrides for vulnerable transitive deps.

Suppressed comments (2)

package.json:84

• This override forces uuid 11.x for google-gax even though google-gax declares uuid ^9.0.1 (see package-lock.json). That’s outside the supported semver range and could be a breaking runtime change. If you need this for the GHSA mitigation, consider at least pinning the exact patched version to reduce unexpected upgrades.

      "uuid": "^11.1.1"

package.json:87

• This override forces uuid 11.x for teeny-request even though teeny-request declares uuid ^9.0.0 (see package-lock.json). That’s outside the supported semver range and could be a breaking runtime change. If you need this for the GHSA mitigation, consider at least pinning the exact patched version to reduce unexpected upgrades.

      "uuid": "^11.1.1"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.