[DaichiMatsumoto]

Description

Upgrade the Thrift dependency from ^0.20.0 to ^0.23.0 in the library package, its JSR import map, and the root development dependency. Regenerate pnpm-lock.yaml using pnpm 12.16.1.

0.23.0 is the minimum patched release for both public advisories currently reported against 0.20.0:

• GHSA-r67j-r569-jrwp
• GHSA-526f-jxpj-jmg2

Use the patched 0.23.x line rather than an override, so published npm and JSR consumers also receive the updated dependency constraint. The latest Thrift release is 0.25.0; this change deliberately targets the minimum patched minor release to limit the upgrade scope.

This is a dependency update, not a claim that every advisory is exploitable through LINEJS or that dependency audit results prove the safety of LINEJS's own parsing code. No application protocol code or generated schema is changed.

Validation

Node 24.22.1; pnpm 12.16.1.

• Passed: pnpm install --frozen-lockfile
• Passed: pnpm run build
• Passed: pnpm run check (format, lint, TypeScript)
• Passed: pnpm run test:scripts (20 tests)
• Passed: agent tests (24) and separately run CLI tests (59)
• pnpm test: 343 library tests passed; two live STUN/ICE tests failed because this sandbox cannot enumerate network interfaces / resolve stun.l.google.com. The recursive runner therefore did not reach the CLI, which was tested separately.
• Passed: library rerun excluding only those two live-network test names (343 passed, 2 skipped), including the existing Binary/Compact protocol round-trip tests.
• Passed: built CLI --help and --version.
• Passed: pnpm audit --prod --json (zero advisories).
• Full pnpm audit --json still reports nine pre-existing development-tool advisories via docs/Vite/esbuild (1 high, 7 moderate, 1 low); no Thrift advisories remain.

No real LINE account, authentication, message sending, or live LINE requests were used. CI still needs to run on the submitted commit before this is ready to merge.

Checklist

• Build, lint, types, and offline tests
• Full test suite in an environment supporting the live STUN/ICE tests