From abd33dea3e2c233b215d4e963767e3516c4f0ce3 Mon Sep 17 00:00:00 2001 From: Daniel Bannert Date: Tue, 6 Oct 2026 14:36:21 +0200 Subject: [PATCH] fix(deps): resolve the audit gate `pnpm audit` fails the setup step of every workflow. Fix what has a patched release and ignore what does not: - nx 23.1.1 -> 23.2.1 in the default catalog (GHSA-w3vv-58gj-gw77, GHSA-hrvq-x7jp-36xv) - override source-map-js to >=1.2.2 (GHSA-68fv-2mgg-jv7q) - override tinypool to >=2.1.2 (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr) - ignore sprintf-js (no patched release) and katex (fix is 0.18.2 but micromark-extension-math needs ^0.16.0); both dev-only --- pnpm-lock.yaml | 151 +++++++++++++++++++++----------------------- pnpm-workspace.yaml | 12 +++- 2 files changed, 83 insertions(+), 80 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index db0757832..d5d6075f1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -72,8 +72,8 @@ catalogs: specifier: 17.3.0 version: 17.3.0 nx: - specifier: 23.1.1 - version: 23.1.1 + specifier: 23.2.1 + version: 23.2.1 pkg-pr-new: specifier: 0.0.88 version: 0.0.88 @@ -618,6 +618,8 @@ overrides: http-cache-semantics@<=4.2.0: '>=4.3.0 <5' form-data@>=4.0.0 <4.0.6: '>=4.0.6' js-yaml@>=4.0.0 <4.3.0: ^4.3.2 + source-map-js@<1.2.2: '>=1.2.2' + tinypool@<2.1.2: '>=2.1.2' packageExtensionsChecksum: sha256-MjAIE7G6Co++8ZSfBPkLyV3w3Rk1vr3erem+CmhDnvQ= @@ -675,7 +677,7 @@ importers: version: 17.3.0 nx: specifier: 'catalog:' - version: 23.1.1 + version: 23.2.1 pkg-pr-new: specifier: 'catalog:' version: 0.0.88 @@ -3138,57 +3140,57 @@ packages: resolution: {integrity: sha512-pwK+BfEBZJbKdNYpHHRTNBwBoqrN/iIMO0AiGvYsp3Hoaq0WbgGSWQR6SCldZovoDpY3yje5lkFUe6gsDgJ2vg==} engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0} - '@nx/nx-darwin-arm64@23.1.1': - resolution: {integrity: sha512-Rq/RXLX5uIvJQfb6kuUgEirquT5ARaAgQyNaMZVnOPAL5wuxaDvQag8WX/WUCIgbUKZuGkclJwM7Vlnvtn3bdg==} + '@nx/nx-darwin-arm64@23.2.1': + resolution: {integrity: sha512-majzvZlhlWL8MSDEKbQoGv3qM1u7v8Pk7X86srWsySbGDnCJ5BpMFyqMeroQ3AY4lxRjLYWACX5YXVPy2ttRtQ==} cpu: [arm64] os: [darwin] - '@nx/nx-darwin-x64@23.1.1': - resolution: {integrity: sha512-doWaPLPd6yUas3FhQJqMAScupCsToeTedK4RRWm700VhHoVdBTN4ejIBRBfoiT/SPAwY6EOHb8uFDJhGo7geMg==} + '@nx/nx-darwin-x64@23.2.1': + resolution: {integrity: sha512-C+KkJwGOZ3h2RjEoQk2SWBdMlKq4BdMfTtxCJ9YgCxjPKqT8V/57tn1Dzz9fnw76P8+PocsfRdjIS0cj9r7isA==} cpu: [x64] os: [darwin] - '@nx/nx-freebsd-x64@23.1.1': - resolution: {integrity: sha512-9rDZKBPGuX8mid11RimJ2ENqDYZpPZhrqTlI9q/VnqcPLq0Bw/8AhqCKhBVlfNqJjbi4OsRQYDK7UkqIlcfThg==} + '@nx/nx-freebsd-x64@23.2.1': + resolution: {integrity: sha512-GxxMtUlZWy74b15iyHVw+c4a0V2pSHR6RKbvmaSJQ3BXJrJarIqaWys/JrvcV2I/AjtrN7Tq7cFxCEaxkwCsEA==} cpu: [x64] os: [freebsd] - '@nx/nx-linux-arm-gnueabihf@23.1.1': - resolution: {integrity: sha512-NDR5X2HiD6WU3JEaDJmOLteIGIFqjrjkzoFWrQke2Y1oCRYu+UyFdPeaMVUyAs5OyUx4U+SD+eBQPTCNbWmazA==} + '@nx/nx-linux-arm-gnueabihf@23.2.1': + resolution: {integrity: sha512-Wr/VLZkPhEsDN7GGx0wOmvZ6v7yMrMf9WpLfrcTVe10NPUB/y6xYaoTDo8teKOBNLsPJ73C40bj2ZBmWtGPg7Q==} cpu: [arm] os: [linux] - '@nx/nx-linux-arm64-gnu@23.1.1': - resolution: {integrity: sha512-tWDHJII8+aHweTzHelf5dGM6qGNmHbAPhCc3jrtrM0uE+UD/wt2Dpq7H3086Iyia9M9jGM9sYpuD/6W6WAFAMA==} + '@nx/nx-linux-arm64-gnu@23.2.1': + resolution: {integrity: sha512-lGPhJYkJbIlTWj38FrHZ3qnaGkAfafPrK+6KjGdt+ubDOt9fp0lyUbEhfdg9JuIL++hOgcTHvz0FOA6S+7k3nA==} cpu: [arm64] os: [linux] libc: [glibc] - '@nx/nx-linux-arm64-musl@23.1.1': - resolution: {integrity: sha512-t7iVMZ7Cj3LmPcfaYt9KOkojpuC5XRmtZ/0G+NBMA2GuRhCVbzpOgUCob0nQMV2TrTwn5oAWJeDc4xLni+oteg==} + '@nx/nx-linux-arm64-musl@23.2.1': + resolution: {integrity: sha512-HrHBmBjh++NBE1p0DBjnc53Ech86/4gy4V1bAUJRViG1/FSJAopKE8qQqanYfShOUsHXk6ohPIhf6nlC8LsFFQ==} cpu: [arm64] os: [linux] libc: [musl] - '@nx/nx-linux-x64-gnu@23.1.1': - resolution: {integrity: sha512-stuCayctOt/4AFvxKYgGTPluUc0HW7DcyTz9yeTMl/zj0+FENEr8RCTjInD0Q5qVGzYphma6SssVSh432w5agw==} + '@nx/nx-linux-x64-gnu@23.2.1': + resolution: {integrity: sha512-D1mSU/kdC1N8aeo7RpmuXWOl77GR4QIbam4dpUmezAwdNkIHlIq7hwqec+4HDWum9nlNmQX/dZn0nZaBem0rRA==} cpu: [x64] os: [linux] libc: [glibc] - '@nx/nx-linux-x64-musl@23.1.1': - resolution: {integrity: sha512-cZSUqGV+iHda39W91BNKSysSu6OFfR6M4ViQBcMtbwq3ce19gDr2f23MqGZEQZtaD/eSQ9UNEhx09nhrdYxWDg==} + '@nx/nx-linux-x64-musl@23.2.1': + resolution: {integrity: sha512-p8Lc4RLu7cj4iP7NCnivLv4Qw+RorrLRO6s2J0LNIMH4nI1PAu5p5IztsCb3lsRo0f/ERCQ8DGwBn2BM1J8Blg==} cpu: [x64] os: [linux] libc: [musl] - '@nx/nx-win32-arm64-msvc@23.1.1': - resolution: {integrity: sha512-iDlYbFHgTYV5lg1ypEt+LAj86o/uyy6vR0ha5pcUs4FqXzQgy14lOeyRod/EZs9Er3DIyJlEi/rpEvaP99/Hag==} + '@nx/nx-win32-arm64-msvc@23.2.1': + resolution: {integrity: sha512-XWYG+6P368xOZXU1z3QH4jXlaajQDxlXVGzYXogp+i09twEAhE7LV6fmv8gQptBta67EZy610KcKu38IVn6x7Q==} cpu: [arm64] os: [win32] - '@nx/nx-win32-x64-msvc@23.1.1': - resolution: {integrity: sha512-UD21AHWJ2PEA+PuANPCt+lj3kYpAzYNq+bm4VCbrt3KZd7zDPas0ns85UIhfrhsNiSmYzjWz2/JDk2S3cA6lGw==} + '@nx/nx-win32-x64-msvc@23.2.1': + resolution: {integrity: sha512-qZQBNB4L/yljM81Fm5M/LoyCMoGJc7yc//KePQ5xiyhzZjJENooHsFkB8ps/pSv4cfHKfYJbvgBAMPOLXeHqqA==} cpu: [x64] os: [win32] @@ -6440,10 +6442,6 @@ packages: ansi-align@3.0.1: resolution: {integrity: sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w==} - ansi-colors@4.1.3: - resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==} - engines: {node: '>=6'} - ansi-escapes@4.3.2: resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==} engines: {node: '>=8'} @@ -7512,10 +7510,6 @@ packages: resolution: {integrity: sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==} engines: {node: '>=10.13.0'} - enquirer@2.3.6: - resolution: {integrity: sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==} - engines: {node: '>=8.6'} - entities@4.5.0: resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==} engines: {node: '>=0.12'} @@ -8255,6 +8249,9 @@ packages: fast-uri@4.2.1: resolution: {integrity: sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==} + fast-wrap-ansi@0.2.0: + resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==} + fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -10482,8 +10479,8 @@ packages: nth-check@2.1.1: resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==} - nx@23.1.1: - resolution: {integrity: sha512-oDdW2JgVllgfyyN6OqlRzeABw0QrlXdxyl9rtOUMMXQzlkpYA1RTs8jinJCe6QSo7aEn0dZ+Ar7dd09hMudBsg==} + nx@23.2.1: + resolution: {integrity: sha512-QOgM7EcJ6gvLKZ3Azno7wdoXXhRhZHbRDN79gCmGXsBxH9WBXCeSy3DyGdee/d5Fa6GnxVOgwKTCx8l0eA+vHw==} hasBin: true peerDependencies: '@swc-node/register': ^1.11.1 @@ -11566,8 +11563,8 @@ packages: engines: {node: '>=22'} hasBin: true - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -12087,10 +12084,6 @@ packages: resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==} engines: {node: '>=12.0.0'} - tinypool@2.1.0: - resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==} - engines: {node: ^20.0.0 || >=22.0.0} - tinypool@2.2.0: resolution: {integrity: sha512-jBrmx4lYmaC9k/mgPbylxs7kBUxHtD8256up+HjLaDFfXScKJQyil+SWXSvhAtT7XHo+yTVlpB81PGmHP8oLSQ==} engines: {node: ^20.0.0 || >=22.0.0} @@ -14518,7 +14511,7 @@ snapshots: '@eslint/css-tree@4.1.0': dependencies: mdn-data: 2.34.0 - source-map-js: 1.2.1 + source-map-js: 1.2.2 '@eslint/css@1.4.0': dependencies: @@ -15017,34 +15010,34 @@ snapshots: '@npmcli/name-from-folder@2.0.0': {} - '@nx/nx-darwin-arm64@23.1.1': + '@nx/nx-darwin-arm64@23.2.1': optional: true - '@nx/nx-darwin-x64@23.1.1': + '@nx/nx-darwin-x64@23.2.1': optional: true - '@nx/nx-freebsd-x64@23.1.1': + '@nx/nx-freebsd-x64@23.2.1': optional: true - '@nx/nx-linux-arm-gnueabihf@23.1.1': + '@nx/nx-linux-arm-gnueabihf@23.2.1': optional: true - '@nx/nx-linux-arm64-gnu@23.1.1': + '@nx/nx-linux-arm64-gnu@23.2.1': optional: true - '@nx/nx-linux-arm64-musl@23.1.1': + '@nx/nx-linux-arm64-musl@23.2.1': optional: true - '@nx/nx-linux-x64-gnu@23.1.1': + '@nx/nx-linux-x64-gnu@23.2.1': optional: true - '@nx/nx-linux-x64-musl@23.1.1': + '@nx/nx-linux-x64-musl@23.2.1': optional: true - '@nx/nx-win32-arm64-msvc@23.1.1': + '@nx/nx-win32-arm64-msvc@23.2.1': optional: true - '@nx/nx-win32-x64-msvc@23.1.1': + '@nx/nx-win32-x64-msvc@23.2.1': optional: true '@octokit/auth-token@6.0.0': {} @@ -17889,7 +17882,7 @@ snapshots: oxc-resolver: 11.24.2 p-queue: 9.3.1 rollup: 4.62.2 - source-map-js: 1.2.1 + source-map-js: 1.2.2 optionalDependencies: lightningcss: 1.33.0 postcss: 8.5.25 @@ -17916,7 +17909,7 @@ snapshots: oxc-resolver: 11.24.2 p-queue: 9.3.1 rollup: 4.62.2 - source-map-js: 1.2.1 + source-map-js: 1.2.2 optionalDependencies: lightningcss: 1.33.0 postcss: 8.5.25 @@ -18336,8 +18329,6 @@ snapshots: dependencies: string-width: 4.2.3 - ansi-colors@4.1.3: {} - ansi-escapes@4.3.2: dependencies: type-fest: 0.21.3 @@ -19089,12 +19080,12 @@ snapshots: css-tree@2.2.1: dependencies: mdn-data: 2.0.28 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css-tree@3.2.1: dependencies: mdn-data: 2.27.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css-what@7.0.0: {} @@ -19406,10 +19397,6 @@ snapshots: graceful-fs: 4.2.11 tapable: 2.3.3 - enquirer@2.3.6: - dependencies: - ansi-colors: 4.1.3 - entities@4.5.0: {} entities@7.0.1: {} @@ -20700,6 +20687,10 @@ snapshots: fast-uri@4.2.1: {} + fast-wrap-ansi@0.2.0: + dependencies: + fast-string-width: 3.0.2 + fast-wrap-ansi@0.2.2: dependencies: fast-string-width: 3.0.2 @@ -22354,7 +22345,7 @@ snapshots: dependencies: '@babel/parser': 7.29.8 '@babel/types': 7.29.8 - source-map-js: 1.2.1 + source-map-js: 1.2.2 make-asynchronous@1.1.0: dependencies: @@ -23654,8 +23645,10 @@ snapshots: dependencies: boolbase: 1.0.0 - nx@23.1.1: + nx@23.2.1: dependencies: + '@clack/core': 1.4.3 + '@clack/prompts': 1.7.0 '@emnapi/core': 1.4.5 '@emnapi/runtime': 1.4.5 '@emnapi/wasi-threads': 1.0.4 @@ -23665,7 +23658,6 @@ snapshots: '@yarnpkg/lockfile': 1.1.0 '@zkochan/js-yaml': 0.0.7 agent-base: 6.0.2(supports-color@7.2.0) - ansi-colors: 4.1.3 ansi-regex: 5.0.1 ansi-styles: 4.3.0 argparse: 2.0.1 @@ -23698,13 +23690,15 @@ snapshots: ejs: 5.0.1 emoji-regex: 8.0.0 end-of-stream: 1.4.5 - enquirer: 2.3.6 es-define-property: 1.0.1 es-errors: 1.3.0 es-object-atoms: 1.1.1 es-set-tostringtag: 2.1.0 escalade: 3.2.0 escape-string-regexp: 1.0.5 + fast-string-truncated-width: 3.0.3 + fast-string-width: 3.0.2 + fast-wrap-ansi: 0.2.0 figures: 3.2.0 flat: 5.0.2 follow-redirects: 1.16.0(debug@4.4.3(supports-color@7.2.0)) @@ -23757,6 +23751,7 @@ snapshots: safe-buffer: 5.2.1 semver: 7.8.4 signal-exit: 3.0.7 + sisteransi: 1.0.5 smol-toml: 1.9.0 string-width: 4.2.3 string_decoder: 1.3.0 @@ -23777,16 +23772,16 @@ snapshots: yargs: 17.7.2 yargs-parser: 21.1.1 optionalDependencies: - '@nx/nx-darwin-arm64': 23.1.1 - '@nx/nx-darwin-x64': 23.1.1 - '@nx/nx-freebsd-x64': 23.1.1 - '@nx/nx-linux-arm-gnueabihf': 23.1.1 - '@nx/nx-linux-arm64-gnu': 23.1.1 - '@nx/nx-linux-arm64-musl': 23.1.1 - '@nx/nx-linux-x64-gnu': 23.1.1 - '@nx/nx-linux-x64-musl': 23.1.1 - '@nx/nx-win32-arm64-msvc': 23.1.1 - '@nx/nx-win32-x64-msvc': 23.1.1 + '@nx/nx-darwin-arm64': 23.2.1 + '@nx/nx-darwin-x64': 23.2.1 + '@nx/nx-freebsd-x64': 23.2.1 + '@nx/nx-linux-arm-gnueabihf': 23.2.1 + '@nx/nx-linux-arm64-gnu': 23.2.1 + '@nx/nx-linux-arm64-musl': 23.2.1 + '@nx/nx-linux-x64-gnu': 23.2.1 + '@nx/nx-linux-x64-musl': 23.2.1 + '@nx/nx-win32-arm64-msvc': 23.2.1 + '@nx/nx-win32-x64-msvc': 23.2.1 object-assign@4.1.1: {} @@ -24023,7 +24018,7 @@ snapshots: oxfmt@0.35.0: dependencies: - tinypool: 2.1.0 + tinypool: 2.2.0 optionalDependencies: '@oxfmt/binding-android-arm-eabi': 0.35.0 '@oxfmt/binding-android-arm64': 0.35.0 @@ -24400,7 +24395,7 @@ snapshots: dependencies: nanoid: 6.0.1 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 powershell-utils@0.1.0: {} @@ -25301,7 +25296,7 @@ snapshots: sort-object-keys: 2.1.0 tinyglobby: 0.2.17 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: @@ -26014,8 +26009,6 @@ snapshots: fdir: 6.5.0(picomatch@4.0.7) picomatch: 4.0.7 - tinypool@2.1.0: {} - tinypool@2.2.0: {} tinyrainbow@2.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c24ee25d8..cd11cbf5c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -21,6 +21,11 @@ auditConfig: # and 3.0.3 is the latest published version. Reached only through dev-only micromatch, # whose patterns come from our own config. - GHSA-vfj7-8cjw-p6xm + # sprintf-js has no patched release (latest is 1.1.3); dev-only via eslint. + - GHSA-hp3w-g68c-fv3c + # katex is fixed in 0.18.2 but micromark-extension-math (via @eslint/markdown) + # requires ^0.16.0; dev-only eslint markdown. + - GHSA-238p-pmpm-9mq7 ignoreCves: - GHSA-v2wj-q39q-566r - GHSA-p9ff-h696-f583 @@ -42,7 +47,7 @@ catalog: husky: ^9.1.7 is-ci: ^4.1.0 lint-staged: 17.3.0 - nx: 23.1.1 + nx: 23.2.1 pkg-pr-new: 0.0.88 postcss: 8.5.25 prettier: 3.9.6 @@ -319,6 +324,11 @@ overrides: # multi-semantic-release's `import ... from "js-yaml"`. ^4.3.0 still patches GHSA-52cp-r559-cp3m. js-yaml@>=4.0.0 <4.3.0: "^4.3.2" + # GHSA-68fv-2mgg-jv7q (event-loop DoS), fixed in 1.2.2. + source-map-js@<1.2.2: ">=1.2.2" + # GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr (critical) — fixed in 2.1.2. + tinypool@<2.1.2: ">=2.1.2" + shellEmulator: true trustPolicy: no-downgrade