fix(root): resolve moderate file-type vulnerability via open-cli upgrade

[cursor]

Summary

Upgrades open-cli from ^6.0.1 to ^8.0.0 in packages/stateless and packages/providers to resolve a moderate severity vulnerability in file-type.

Vulnerability Details

• Advisory: GHSA-5v7r-6r5c-r473 (CVE-2026-31808)
• Severity: Moderate
• Package: file-type (versions >=13.0.0 <21.3.1)
• Impact: A denial of service vulnerability in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. An attacker can stall the Node.js event loop with a 55-byte payload.

Fix Strategy

Replace parent dependency — open-cli@6 brought in file-type@16.5.4 (CJS), which was in the vulnerable range. Upgrading to open-cli@8 shifts the dependency to file-type@^18.7.0, which is then resolved to ^21.3.4 by the existing pnpm override (file-type@>=17.0.0 <21.3.4: ^21.3.4), a version that includes the security fix.

open-cli is a devDependency used only for opening documentation in a browser — upgrading it from v6 to v8 is low-risk. v8 is ESM-only (type: "module") with engines: { node: ">=18" }, which is compatible with the monorepo's Node 20 environment and is fine since it's only used as a CLI binary.

Changes

• packages/stateless/package.json: open-cli ^6.0.1 → ^8.0.0
• packages/providers/package.json: open-cli ^6.0.1 → ^8.0.0
• Updated pnpm-lock.yaml

Verification

• pnpm audit confirms the file-type advisory (1114301) is no longer present
• pnpm build:v2 passes successfully

  

[netlify]

✅ Deploy Preview for dashboard-v2-novu-staging canceled.

Name	Link
🔨 Latest commit	7064e60
🔍 Latest deploy log	https://app.netlify.com/projects/dashboard-v2-novu-staging/deploys/69dc9b4aabb0de0008ba2d94

[github-actions]

Hey there and thank you for opening this pull request! 👋

We require pull request titles to follow specific formatting rules and it looks like your proposed title needs to be adjusted.

Your PR title is: fix(root): resolve moderate file-type vulnerability via open-cli upgrade

Requirements:

1. Follow the Conventional Commits specification
2. As a team member, include Linear ticket ID at the end: fixes TICKET-ID or include it in your branch name

Expected format: feat(scope): Add fancy new feature fixes NOV-123

Details:

PR title must end with 'fixes TICKET-ID' (e.g., 'fixes NOV-123') or include ticket ID in branch name