chore: fix broken pnpm-lock.yaml (duplicate oauth4webapi@3.8.7 key)

[Piyush-85]

Description

Fixes a broken pnpm-lock.yaml that failed pnpm install --frozen-lockfile with ERR_PNPM_BROKEN_LOCKFILE: duplicated mapping key. A dependabot merge (#2809, oauth4webapi 3.8.6 → 3.8.7) doubled the oauth4webapi@3.8.7 entry in both the packages and snapshots sections. The duplicate blocks were byte-identical, so this removes the redundant copies (5-line deletion, no resolution changes).

Testing

• pnpm install --frozen-lockfile passes (exit 0)

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d2494ce9-9b65-4ba2-9bd8-a32aef56dabd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.99%. Comparing base (6d5328f) to head (9a768ad).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2816   +/-   ##
=======================================
  Coverage   87.99%   87.99%           
=======================================
  Files          80       80           
  Lines       11516    11516           
  Branches     2385     2385           
=======================================
  Hits        10133    10133           
  Misses       1338     1338           
  Partials       45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[semgrepcode-auth0]

Semgrep found 1 ssc-7b3c1e5a-9d24-4f80-b6a1-2c8e0f35d719 finding:

• pnpm-lock.yaml
  • L1872 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.1 at nextjs-auth0/pnpm-lock.yaml:1872.

Reference(s): GHSA-5p4m-2wfm-xmqj

Semgrep found 1 ssc-8ec0dd3e-cfd5-4a9b-9479-f5400432931f finding:

• pnpm-lock.yaml
  • L2305 - Triage

Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader (vipsload, CVE-2026-33327), an integer overflow in the GIF loader (gifload, CVE-2026-33328) causing a denial of service on 32-bit hosts only, a heap-based buffer overflow in the TIFF loader (tiffload, CVE-2026-35591) when handling JPEG or JPEG2000-encoded tiles, and an out-of-bounds read in the EXIF directory decoder (CVE-2026-35590). An attacker who can supply a crafted image can crash the process or corrupt heap memory. Because sharp selects the libvips loader by sniffing the input bytes, no call site can be shown to be safe, and the EXIF flaw is reachable from the JPEG, TIFF, WebP, PNG and HEIF loaders as well. Upgrade to sharp 0.35.0 or later, which bundles libvips 8.18.3. Blocking the affected loaders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }) is only a partial stopgap and does not mitigate the EXIF out-of-bounds read (CVE-2026-35590), for which no workaround exists.

Fix: Upgrade this library to at least version 0.35.0 at nextjs-auth0/pnpm-lock.yaml:2305.

Reference(s): GHSA-f88m-g3jw-g9cj