chore(deps): Bump @spinframework/build-tools from 1.0.7 to 2.1.0 in /experiments/003_wasm_compile/js-spin

[dependabot]

Bumps @spinframework/build-tools from 1.0.7 to 2.1.0.

Release notes

Sourced from @​spinframework/build-tools's releases.

v2.1.0

No release notes provided.

build-tools-v2.1.0

Release v2.1.0 for build-tools published to npm.

build-tools-v2.0.0

Release v2.0.0 for build-tools published to npm.

spin-postgres-v2.0.0

Release v2.0.0 for spin-postgres published to npm.

wasi-http-proxy-v2.0.0

Release v2.0.0 for wasi-http-proxy published to npm.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​spinframework/build-tools since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[iheitlager]

Review: holding, not merging yet

Tested this together with #46 (same `@spinframework` v1→v2 release train, same `js-spin/package.json`) in a scratch worktree — merging one without the other would leave a half-upgraded package set, so they were evaluated as a pair.

`spin build` still succeeds with both bumps applied. But `npm audit` goes from 0 vulnerabilities → 5 (4 moderate, 1 critical):

decompress  *
Severity: critical
Decompress: Archive extraction can create files and links outside of the target directory
GHSA-mp2f-45pm-3cg9 / GHSA-h39j-r5qq-r9mm

  @bytecodealliance/weval  *
  Depends on vulnerable versions of decompress
    @bytecodealliance/componentize-js  0.13.0 - 0.18.5 || >=0.19.4-rc.1
    Depends on vulnerable versions of @bytecodealliance/weval
      @spinframework/build-tools  <=1.0.2 || >=2.0.0
      Depends on vulnerable versions of @bytecodealliance/componentize-js
        @spinframework/wasi-http-proxy  >=2.0.0

Pulled in transitively via `build-tools@2.x`'s dependency on `componentize-js`, which depends on a vulnerable `weval`, which depends on a vulnerable `decompress` (Zip Slip — arbitrary file write via archive extraction). Ironically, `npm audit fix --force`'s own suggested remedy is to downgrade `build-tools` back to 1.0.7 — the version this PR moves away from.

Recommendation: hold until upstream (`@bytecodealliance/componentize-js`/`weval`) picks up a patched `decompress`, or pin `decompress` to a safe version via an `overrides` entry in `js-spin/package.json` alongside this bump. Not merging as-is.

---

🤖 Analysis by Claude