Both come in transitively via openapi-typescript → @redocly/openapi-core
(fast-uri through @redocly/ajv, brace-expansion through minimatch).
npm audit on the affected versions reports:

  fast-uri ≤3.1.1 — high — path traversal + host confusion
  (GHSA-q3j6-qgpj-74h6 / GHSA-v39h-62p7-jpjc)
  brace-expansion 4.0.0–5.0.4 — moderate — zero-step sequence
  hangs the process (GHSA-f886-m6hf-6m8v)

Lift both to the patched majors via overrides (alongside the existing
minimatch pin). The override path is preferred over plain dependency
bumps because the SDK doesn't depend on either package directly —
the responsibility for forwarding the fix sits with this repo until
the upstream packages cut new releases that pull the patches in
transitively.

Lands at the bottom of the BC5 stack so the wire-replay PRs above
(#294, #301) inherit the fix on rebase.

Both come in transitively via openapi-typescript → @redocly/openapi-core
(fast-uri through @redocly/ajv, brace-expansion through minimatch).
npm audit on the affected versions reports:

  fast-uri ≤3.1.1 — high — path traversal + host confusion
  (GHSA-q3j6-qgpj-74h6 / GHSA-v39h-62p7-jpjc)
  brace-expansion 4.0.0–5.0.4 — moderate — zero-step sequence
  hangs the process (GHSA-f886-m6hf-6m8v)

Lift both to the patched majors via overrides (alongside the existing
minimatch pin). The override path is preferred over plain dependency
bumps because the SDK doesn't depend on either package directly —
the responsibility for forwarding the fix sits with this repo until
the upstream packages cut new releases that pull the patches in
transitively.

Lands at the bottom of the BC5 stack so the wire-replay PRs above
(#294, #301) inherit the fix on rebase.

* spec(bc5): forward-compat additions + parallel BC4/BC5 provenance

Add optional fields to existing Smithy structures for BC5 read paths,
keeping BC4 readers fully compatible. All additions are opt-in: absent
fields are tolerated, present fields decode through the existing types.

* Notification: bubble_up_url, bubble_up_at (eligibility-gated)
* GetMyNotificationsOutput: bubble_ups, scheduled_bubble_ups; document
  current memories[] behavior pending BC team's back-compat decision
* Person: tagline (alias of bio in BC5)
* Todo: steps (reuses existing CardStep wire shape)
* Todoset: todos_count, completed_loose_todos_count, todos_url, app_todos_url

Restructure spec/api-provenance.json for parallel branch tracking — .bc3
keeps the active-branch baseline (now five), .compatibility.bc3-master
records the BC4 baseline for compatibility tracking. Existing tooling
(sync-spec-version, sync-api-version, Go provenance.go) reads the same
.bc3 keys and works unchanged.

Seed spec/bucket-scoped-allowlist.txt with the only existing bucket-only
list endpoint (webhooks) for the new parity lint.

* build(make): add generate aggregator, parity lint, branch-aware sync-status

* make generate — single command to regenerate every machine-derived
  artifact in the repo (Smithy, behavior model, URL routes, provenance,
  per-language SDKs) in dependency order.

* make check-bucket-flat-parity — new lint that scans openapi.json for
  GET /{accountId}/buckets/{bucketId}/<resource>(/...).json list
  operations and verifies each has a flat counterpart at
  /{accountId}/<resource>.json (or is justified in
  spec/bucket-scoped-allowlist.txt). Cross-project SDK consumers
  shouldn't have to walk every project to query account-wide data.

* make sync-status — reads .bc3.branch and reports drift for the active
  branch (now five) and the compatibility branch (master) as two
  clearly-labeled blocks via scripts/report-bc3-drift.sh, instead of
  silently mixing them under HEAD.

* make validate-api-gaps target wired into make check (script lands in
  the api-gaps registry commit).

* docs(api-gaps): API gap registry + SDK↔BC3 coordination + validator

The SDK is the client-side demand signal for BC3 API coverage. spec/api-gaps/
is a durable, schema-validated registry: each entry tracks one BC5
user-visible feature that ships without (or with incomplete) JSON API
coverage, paired with the BC3 parity plan that owns server-side delivery.
Status changes flow through git history, making the absorption journey
publicly auditable.

Initial registry (11 entries aligned with BC3 plan Phase 3 deliverables):

* calendar — show/update only
* scratchpad — URL path deferred by BC3 plan
* step-top-level — doc-only addition (existing partial)
* everything-aggregates — Phase 3c flat top-level recording listings (~22)
* activity-timeline — /activity (global) + /projects/:id/timeline
* recordable-subtypes-doc — Journal, CloudFile, GoogleDocument; Door excluded
  (read paths + create operations per BC3 Phase 3a)
* stack-doc-and-smithy — full CRUD + list collectables
* search-filter-additions — additive filter params
* rich-text-project-attachable — Project as Attachable
* recording-bubbleupable-field — additive boolean
* todoset-completed-list-visibility — pending BC3 classification

Tooling:
* spec/api-gaps/schema.json + allowlist-schema.json validate frontmatter
* allowlist.yml records routes that don't warrant a registry entry
  (transient nav state, duplicates already covered elsewhere)
* scripts/validate-api-gaps.{sh,rb} — Ruby stdlib only, no gem deps

COORDINATION.md (root) describes the SDK ↔ BC3 plan relationship and the
absorption lifecycle for anyone reading the SDK repo cold.

CONTRIBUTING.md picks up the api-gaps section, the parity lint section,
and points at make generate as the single command to regenerate
everything.

* ts: regenerate from BC5 spec additions

* ruby: regenerate from BC5 spec additions

* python: regenerate from BC5 spec additions

* kotlin: regenerate from BC5 spec additions

* swift: regenerate from BC5 spec additions

* go: regenerate from BC5 spec additions

* typescript: pin fast-uri and brace-expansion via overrides

Both come in transitively via openapi-typescript → @redocly/openapi-core
(fast-uri through @redocly/ajv, brace-expansion through minimatch).
npm audit on the affected versions reports:

  fast-uri ≤3.1.1 — high — path traversal + host confusion
  (GHSA-q3j6-qgpj-74h6 / GHSA-v39h-62p7-jpjc)
  brace-expansion 4.0.0–5.0.4 — moderate — zero-step sequence
  hangs the process (GHSA-f886-m6hf-6m8v)

Lift both to the patched majors via overrides (alongside the existing
minimatch pin). The override path is preferred over plain dependency
bumps because the SDK doesn't depend on either package directly —
the responsibility for forwarding the fix sits with this repo until
the upstream packages cut new releases that pull the patches in
transitively.

Lands at the bottom of the BC5 stack so the wire-replay PRs above
(#294, #301) inherit the fix on rebase.

* spec: address Copilot review threads on bucket-parity lint + brief

scripts/check-bucket-flat-parity.sh — drop `--slurpfile spec` and read
the spec via positional input instead. The previous form passed the
spec to jq twice (once via --slurpfile, once positionally), so jq
parsed it twice per invocation. Reading once via positional input then
binding `. as \$s` for cross-iteration access preserves the same
schema-resolution behavior with a single parse.

spec/api-gaps/todoset-completed-list-visibility.md — rewrite the
"PR 1 must classify" sentence so the constraint reads on its own,
without requiring the umbrella-plan cross-reference. The brief now
notes that classification must come from the BC3 side and the brief
stays in the registry either way; readers no longer need to know
which PR "PR 1" referred to.

* make: iterate compatibility provenance blocks generically in sync-status

The sync-status target hardcoded the .compatibility.bc3-master key, which
broke when the post-launch repin renamed the BC4 baseline block to
bc3-four (BC4 now lives on the four branch; master is BC5). Loop over
.compatibility | keys[] instead so any set of compatibility baselines
gets its own labeled drift report without further Makefile edits.

* regen: reconcile generated artifacts after rebase onto main

make generate over the hand-merged spec picks up both main's project
schedule dates (#302) and this branch's BC5 forward-compat additions,
and stamps the api-provenance repin (bc3 = master @ 415b54cc, BC4
compatibility baseline = four @ 9d73959a) through the Go provenance
mirror. go.work.sum picks up entries from the go generate dep download.

* typescript: bump fast-uri, brace-expansion, js-yaml overrides for fresh advisories

Three high-severity advisories published since main's last green security
run (2026-07-20) trip npm Audit on the TypeScript SDK:

- fast-uri GHSA-4c8g-83qw-93j6 (host confusion via failed IDN
  canonicalization): override >=3.1.2 -> >=3.1.3, resolves 4.1.1
- brace-expansion GHSA-3jxr-9vmj-r5cp (DoS via exponential expansion):
  override >=5.0.6 -> >=5.0.7
- js-yaml GHSA-52cp-r559-cp3m (quadratic CPU via merge-key chains):
  new override ^4.3.0, pinned to the 4.x patched line since js-yaml 5
  is a major bump for openapi-typescript's transitive use

npm audit clean; ts-generate + ts-generate-services + ts-check verified
green under the new resolutions.

* make, scripts: address review threads on sync-status + parity lint

- sync-status: pass BC3_REPO through to report-bc3-drift.sh in both the
  primary and compatibility invocations — make variables aren't exported
  to recipe environments, so 'make sync-status BC3_REPO=org/fork' was
  silently querying the default repo
- parity lint: use [[:space:]] instead of the non-POSIX \s escape in the
  allowlist filter; accept {projectId} alongside {bucketId} in the
  bucket-path pattern (and strip logic) for forward-compat with the
  documented Smithy path convention; use # as the sed delimiter to keep
  the ERE alternation unambiguous across GNU/BSD sed

Candidate count and lint verdict unchanged (verified against openapi.json
before/after).

* make, scripts: second review round on sync-status + parity lint

- parity lint: accept literal filter segments (e.g. /todos/completed.json)
  in addition to path-parameter variants — the header always promised
  (/<filter>)? coverage but the regex only matched /{param}. Candidate
  set unchanged today (verified: single-resource GETs carry no .json
  suffix in this spec, so the anchor keeps the match tight).
- sync-status: guard on jq alongside the existing gh guards.

…reate-bucket-scope-20260601145434

* origin/main: (28 commits)
  Upstream sync: repin provenance to bc3 ba105ba7 (2026-07-22), register post-train contracts, codify pin semantics (basecamp#390)
  ci: pin conformance uv sync to the matrix Python; parse the fan-in gate (basecamp#388)
  BC5 readiness: pairwise BC4↔BC5 + check-bc5-compat orchestrator + scheduled CI (basecamp#308)
  CI: fold conformance suites into their language test jobs (basecamp#387)
  Fix TypeScript SDK Content-Type on GET requests (basecamp#384)
  BC5 launch reconciliation: registry refresh for the shipped BC5 API train (basecamp#325)
  BC5 readiness: cross-language wire-replay decoders (basecamp#301)
  BC5 readiness: Go wrapper forward-compat audit + field-level drift check (basecamp#309)
  BC5 readiness: TypeScript live wire-capture canary (basecamp#294)
  BC5 readiness: forward-compat spec, briefs, parity lint (basecamp#293)
  deps(ts): bump brace-expansion from 5.0.2 to 5.0.7 in /typescript (basecamp#386)
  typescript: bump fast-uri, brace-expansion, js-yaml overrides for fresh advisories (basecamp#385)
  deps(actions): bump the actions group with 6 updates (basecamp#382)
  deps(ruby): bump the bundler-dependencies group in /ruby with 2 updates (basecamp#379)
  deps(kotlin): bump the gradle-dependencies group (basecamp#383)
  deps(go): bump github.com/oapi-codegen/oapi-codegen/v2 in /go (basecamp#381)
  deps(ts): bump the npm-dependencies group in /typescript with 2 updates (basecamp#380)
  deps(smithy): bump the smithy-gradle-dependencies group (basecamp#378)
  deps(go): bump github.com/oapi-codegen/runtime (basecamp#377)
  Todos Update/Edit/Replace: merge-safe writes across all 6 SDKs (basecamp#375)
  ...

# Conflicts:
#	go/pkg/basecamp/api-provenance.json
#	go/pkg/basecamp/version.go
#	go/pkg/generated/client.gen.go
#	kotlin/sdk/src/commonMain/kotlin/com/basecamp/sdk/BasecampConfig.kt
#	openapi.json
#	python/src/basecamp/_version.py
#	ruby/lib/basecamp/generated/metadata.json
#	ruby/lib/basecamp/generated/types.rb
#	ruby/lib/basecamp/version.rb
#	spec/api-provenance.json
#	spec/basecamp.smithy
#	swift/Sources/Basecamp/BasecampConfig.swift
#	typescript/src/client.ts
#	typescript/src/generated/metadata.ts
#	typescript/src/generated/openapi-stripped.json