chore: Bump ses from 1.14.0 to 1.15.0

[dependabot]

Bumps ses from 1.14.0 to 1.15.0.

Release notes

Sourced from ses's releases.

ses@1.15.0

Minor Changes

• #2895 1834932 Thanks @​gibson042! - - Adds assert.makeError and deprecates assert.error as an alias, matching the API already exported from @endo/errors.

  • Before this version, the assert left in global scope before lockdown would redact errors and would be replaced by lockdown with a version that did not redact errors if the caller opted-in with errorTaming set to one of the unsafe variants. After this version, the reverse is true: the assert left in global scope before lockdown does not redact. Then, lockdown replaces assert with a redacting assert unless the caller opted-out with errorTaming set to one of the unsafe variants.

• #3008 a29ecd4 Thanks @​kriskowal! - - lockdown and repairIntrinsics now detect when code has already called a harden imported from @endo/harden before lockdown, and fail with a clear error about hardened modules executing before lockdown.

  • Adds Object[Symbol.for('harden')] as a variant of globalThis.harden that cannot be overridden by an endowment named harden in compartments.

Changelog

Sourced from ses's changelog.

1.15.0

Minor Changes

• #3082 2e00276 Thanks @​boneskull! - - Adds assert.makeError and deprecates assert.error as an alias, matching the API already exported from @endo/errors.

  • Before this version, the assert left in global scope before lockdown would redact errors and would be replaced by lockdown with a version that did not redact errors if the caller opted-in with errorTaming set to one of the unsafe variants. After this version, the reverse is true: the assert left in global scope before lockdown does not redact. Then, lockdown replaces assert with a redacting assert unless the caller opted-out with errorTaming set to one of the unsafe variants.

• #3008 a29ecd4 Thanks @​kriskowal! - - lockdown and repairIntrinsics now detect when code has already called a harden imported from @endo/harden before lockdown, and fail with a clear error about hardened modules executing before lockdown.

  • Adds Object[Symbol.for('harden')] as a variant of globalThis.harden that cannot be overridden by an endowment named harden in compartments.

Commits

• 88d9223 Version Packages
• 12aa580 test: stabilize networked test runs
• 8c33e1f refactor: Drive-by specificity of t.truthy t.falsy to t.true and t.false
• a29ecd4 feat(ses): Sense @​endo/harden usage before lockdown
• 9942e52 chore: consolidate & reformat CHANGELOG.md/NEWS.md files
• e8dbc77 fix(ses): wire up live bindings for reexports early to allow them working in ...
• 6cf7f5d fix(ses): re-exported names available in imported modules
• fe327c1 chore(ses): Restrict commons.js to discourage unsafe use
• 3e306bf feat(ses): Use a Set to speed up name filtering for evaluator scope optimization
• 0a61750 feat(ses): Increase defense against other RegExp.prototype poisoning
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by boneskull, a new releaser for ses since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Low scope (dependency bump only), but ses affects sandboxing/lockdown behavior and could subtly change error-taming or harden/lockdown interactions at runtime.

Overview
Bumps the ses dependency from ^1.14.0 to ^1.15.0 in snaps-execution-environments and snaps-utils.

Updates yarn.lock to resolve ses@1.15.0 (new lock entry/checksum) and repoints the workspace dependency ranges accordingly.

^{Written by Cursor Bugbot for commit 189521f. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ses@​1.15.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• ses@1.15.0

View full report

[FrederikBolding]

@SocketSecurity ignore npm/ses@1.15.0

Trusted author, I have also verified the diff to the SES dist in its entirety.