chore(deps-dev): clear the new dev-dependency advisories

.github/workflows/check.yml

@@ -68,4 +68,4 @@ jobs:
         run: npm run check:vex
 
       - name: Audit dependencies
-        run: npx --yes audit-ci@7.1.0 --high --allowlist GHSA-jmr9-qjv8-65gv GHSA-7pqw-9j4j-h8q3
+        run: npx --yes audit-ci@7.1.0 --high --allowlist GHSA-jmr9-qjv8-65gv GHSA-7pqw-9j4j-h8q3 GHSA-hp3w-g68c-fv3c

openvex.json

@@ -3,8 +3,8 @@
 	"@id": "https://github.com/brazilian-utils/javascript/blob/main/openvex.json",
 	"author": "Hyan Mandian",
 	"role": "Maintainer of @brazilian-utils/brazilian-utils, see MAINTAINERS.md",
-	"timestamp": "2026-09-18T04:45:00Z",
-	"version": 1,
+	"timestamp": "2026-10-09T06:30:00Z",
+	"version": 2,
 	"statements": [
 		{
 			"vulnerability": {
@@ -47,6 +47,27 @@
 			"status": "not_affected",
 			"justification": "component_not_present",
 			"impact_statement": "extract-zip is a development-only transitive dependency (webdriverio -> @wdio/utils -> @puppeteer/browsers -> extract-zip) used by the browser test runner to unpack browser builds downloaded from the vendors in CI. The published package has zero runtime dependencies, so extract-zip is not present in any released asset and never runs on user input. No patched release of extract-zip exists; the statement is withdrawn when webdriverio drops the dependency."
+		},
+		{
+			"vulnerability": {
+				"@id": "https://github.com/advisories/GHSA-hp3w-g68c-fv3c",
+				"name": "GHSA-hp3w-g68c-fv3c",
+				"description": "sprintf-js denial of service through unbounded precision specifiers"
+			},
+			"timestamp": "2026-10-09T06:30:00Z",
+			"products": [
+				{
+					"@id": "pkg:npm/%40brazilian-utils/brazilian-utils",
+					"subcomponents": [
+						{
+							"@id": "pkg:npm/sprintf-js@1.0.3"
+						}
+					]
+				}
+			],
+			"status": "not_affected",
+			"justification": "component_not_present",
+			"impact_statement": "sprintf-js is a development-only transitive dependency (@microsoft/api-extractor -> @rushstack/ts-command-line -> argparse -> sprintf-js) that formats the tool's own messages while the API report is built in CI. The published package has zero runtime dependencies, so sprintf-js is not present in any released asset and never formats user input. No patched release of sprintf-js exists; the statement is withdrawn when argparse drops the dependency."
 		}
 	]
 }

osv-scanner.toml

@@ -5,3 +5,7 @@ reason = "extract-zip is a development-only transitive dependency of webdriverio
 [[IgnoredVulns]]
 id = "GHSA-7pqw-9j4j-h8q3"
 reason = "extract-zip is a development-only transitive dependency of webdriverio (browser tests); no patched release exists and it never runs on user input"
+
+[[IgnoredVulns]]
+id = "GHSA-hp3w-g68c-fv3c"
+reason = "sprintf-js is a development-only transitive dependency of @microsoft/api-extractor (through argparse); no patched release exists and it only formats the tool's own messages, never user input"