From a278095f0109464a80fff2d4f671fdb75356e904 Mon Sep 17 00:00:00 2001
From: redanthrax <gary@4c.gg>
Date: Mon, 10 Aug 2026 08:42:46 -0700
Subject: [PATCH 1/2] Fix pnpm audit vulnerabilities

---
 pnpm-lock.yaml      | 25 ++++++++++++++-----------
 pnpm-workspace.yaml | 41 ++++++++++++++++++-----------------------
 2 files changed, 32 insertions(+), 34 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 85f7c4e..f3ca0f4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,10 +5,13 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  brace-expansion@>=4.0.0 <5.0.9: '>=5.0.9'
+  form-data: 4.0.6
   lodash: 4.18.1
-  uuid: 11.1.1
   minimatch: 10.2.5
-  form-data: 4.0.6
+  nanoid@<3.3.16: '>=3.3.16'
+  nanoid@<3.3.17: '>=3.3.17'
+  uuid: 11.1.1
 
 importers:
 
@@ -414,8 +417,8 @@ packages:
   bl@5.1.0:
     resolution: {integrity: sha512-tv1ZJHLfTDnXE6tMHv73YgSJaWR2AFuPwMntBe7XL/GBFHnT0CLnsHMogfk5+GzCDC5ZWarSCYaIGATZt9dNsQ==}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+  brace-expansion@5.0.9:
+    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -1063,9 +1066,9 @@ packages:
   nan@2.28.0:
     resolution: {integrity: sha512-fTsDz99OTq2sVePhGdp4qQhggZFtKr64ZNVyVajRKtMOkJxYekplBh577PiJB12v/D3s2E5cGtOI45LWp6rnLQ==}
 
-  nanoid@3.3.8:
-    resolution: {integrity: sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==}
-    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+  nanoid@6.0.1:
+    resolution: {integrity: sha512-3wVS3i51pE2pi1k5FFL/95BGfVS0kSsvDVuGXHOtxox/TywUmtgq+3qiTOTbs9J7KfHaXPiN171k/A6dBnaXFw==}
+    engines: {node: ^22 || ^24 || >=26}
     hasBin: true
 
   natural-compare@1.4.0:
@@ -1647,7 +1650,7 @@ snapshots:
   '@n8n/utils@1.42.0':
     dependencies:
       '@n8n/constants': 0.33.0
-      nanoid: 3.3.8
+      nanoid: 6.0.1
 
   '@opentelemetry/api-logs@0.220.0':
     dependencies:
@@ -1925,7 +1928,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  brace-expansion@5.0.8:
+  brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
 
@@ -2573,7 +2576,7 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.9
 
   minipass@7.1.3: {}
 
@@ -2621,7 +2624,7 @@ snapshots:
   nan@2.28.0:
     optional: true
 
-  nanoid@3.3.8: {}
+  nanoid@6.0.1: {}
 
   natural-compare@1.4.0: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d5ec461..aec4f1a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,39 +1,34 @@
 packages:
-  - '.'
+  - .
 
-# Supply-chain hardening (see SECURITY.md). Configured here — pnpm 10+ ignores package.json "pnpm".
-# Pin exact versions only (no >=/^/~ ranges). Bump deliberately with lockfile + audit.
-overrides:
-  lodash: '4.18.1'
-  uuid: '11.1.1'
-  minimatch: '10.2.5'
-  form-data: '4.0.6'
+blockExoticSubdeps: true
 
-# Only these packages may run install/build lifecycle scripts (Mini Shai-Hulud defense).
-onlyBuiltDependencies:
-  - isolated-vm
+engineStrict: true
 
-# Dev-only transitive packages with install scripts we intentionally skip (prebuilt or optional native).
 ignoredBuiltDependencies:
   - cpu-features
   - eslint-plugin-n8n-nodes-base
   - ssh2
   - unrs-resolver
 
-# Wait 24h before installing newly published versions.
+managePackageManagerVersions: true
+
 minimumReleaseAge: 1440
+
 minimumReleaseAgeStrict: true
 
-# Block git/tarball resolutions in transitive dependencies.
-blockExoticSubdeps: true
+nodeVersion: 22.22.3
 
-# Fail install when a dependency has unreviewed postinstall scripts (default true; explicit for clarity).
-strictDepBuilds: true
+onlyBuiltDependencies:
+  - isolated-vm
 
-# Enforce package.json engines when resolving deps.
-engineStrict: true
-# Simulate Node 22.22.3 for dependency engines checks (matches CI and README).
-nodeVersion: 22.22.3
+overrides:
+  brace-expansion@>=4.0.0 <5.0.9: '>=5.0.9'
+  form-data: 4.0.6
+  lodash: 4.18.1
+  minimatch: 10.2.5
+  nanoid@<3.3.16: '>=3.3.16'
+  nanoid@<3.3.17: '>=3.3.17'
+  uuid: 11.1.1
 
-# Require the pnpm version declared in package.json "packageManager" (pnpm 10: managePackageManagerVersions).
-managePackageManagerVersions: true
+strictDepBuilds: true

From e4dd9ad7eea22137cf05e5fe48b8dd8d00902e5e Mon Sep 17 00:00:00 2001
From: redanthrax <gary@4c.gg>
Date: Mon, 10 Aug 2026 08:42:56 -0700
Subject: [PATCH 2/2] 2.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6b0026c..711f089 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-itglue",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "An n8n node to connect to IT Glue",
   "keywords": [
     "n8n-nodes-itglue",