From c8152fa4e939f6db7d99dbf80b0e15a3f6f3b90d Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Thu, 15 Oct 2026 21:16:30 -0400 Subject: [PATCH 1/2] fix(deps): resolve open dependabot security alerts --- .changeset/dependabot-security-alerts.md | 7 ++ package.json | 13 +++- pnpm-lock.yaml | 97 +++++++++++++----------- src/services/event-import-service.ts | 5 +- website/hero-animation/package.json | 3 + website/hero-animation/pnpm-lock.yaml | 19 +++-- 6 files changed, 85 insertions(+), 59 deletions(-) create mode 100644 .changeset/dependabot-security-alerts.md diff --git a/.changeset/dependabot-security-alerts.md b/.changeset/dependabot-security-alerts.md new file mode 100644 index 000000000..ffbc4264c --- /dev/null +++ b/.changeset/dependabot-security-alerts.md @@ -0,0 +1,7 @@ +--- +"nostream": patch +--- + +fix(deps): resolve open dependabot security alerts + +Bumps axios to ^1.20.0, stream-json to ^3.7.0 (with the v3 ESM import-shape fix in the event import service) and js-yaml to 4.3.2, and adds pnpm overrides forcing proxy-addr >= 2.0.8, fast-uri >= 3.1.7, brace-expansion >= 1.1.21 <2 / >= 2.1.7 <3 and js-yaml 3.x >= 3.15.2 <4. The hero-animation package stubs its unfixable transitive ip <= 2.0.1 (werift chain, unused at runtime) with @stdlib/utils-noop. diff --git a/package.json b/package.json index 4edc446b2..5391259b5 100644 --- a/package.json +++ b/package.json @@ -175,11 +175,11 @@ "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0", "@opentelemetry/resources": "^2.8.0", "@opentelemetry/sdk-metrics": "^2.8.0", - "axios": "^1.18.0", + "axios": "^1.20.0", "cac": "^7.0.0", "colorette": "^2.0.20", "express": "4.22.1", - "js-yaml": "4.2.0", + "js-yaml": "4.3.2", "knex": "2.4.2", "ora": "^9.3.0", "pg": "8.9.0", @@ -187,7 +187,7 @@ "pino": "^8.21.0", "ramda": "0.28.0", "redis": "4.5.1", - "stream-json": "^2.1.0", + "stream-json": "^3.7.0", "ws": "^8.21.0", "zod": "^3.22.4" }, @@ -196,7 +196,12 @@ }, "pnpm": { "overrides": { - "serialize-javascript": ">=7.0.3 <8" + "serialize-javascript": ">=7.0.3 <8", + "proxy-addr@<2.0.8": ">=2.0.8", + "fast-uri@<3.1.7": ">=3.1.7", + "brace-expansion@<1.1.21": ">=1.1.21 <2", + "brace-expansion@>=2.0.0 <2.1.7": ">=2.1.7 <3", + "js-yaml@>=3.0.0 <3.15.2": ">=3.15.2 <4" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 66adcb9a0..c5adf70b0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,11 @@ settings: overrides: serialize-javascript: '>=7.0.3 <8' + proxy-addr@<2.0.8: '>=2.0.8' + fast-uri@<3.1.7: '>=3.1.7' + brace-expansion@<1.1.21: '>=1.1.21 <2' + brace-expansion@>=2.0.0 <2.1.7: '>=2.1.7 <3' + js-yaml@>=3.0.0 <3.15.2: '>=3.15.2 <4' importers: @@ -33,8 +38,8 @@ importers: specifier: ^2.8.0 version: 2.8.0(@opentelemetry/api@1.9.1) axios: - specifier: ^1.18.0 - version: 1.18.0 + specifier: ^1.20.0 + version: 1.20.0 cac: specifier: ^7.0.0 version: 7.0.0 @@ -45,8 +50,8 @@ importers: specifier: 4.22.1 version: 4.22.1 js-yaml: - specifier: 4.2.0 - version: 4.2.0 + specifier: 4.3.2 + version: 4.3.2 knex: specifier: 2.4.2 version: 2.4.2(pg@8.9.0) @@ -69,8 +74,8 @@ importers: specifier: 4.5.1 version: 4.5.1 stream-json: - specifier: ^2.1.0 - version: 2.1.0 + specifier: ^3.7.0 + version: 3.7.0 ws: specifier: ^8.21.0 version: 8.21.0 @@ -2258,8 +2263,8 @@ packages: resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==} engines: {node: '>=8.0.0'} - axios@1.18.0: - resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==} + axios@1.20.0: + resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==} axobject-query@4.1.0: resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==} @@ -2311,11 +2316,11 @@ packages: resolution: {integrity: sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw==} engines: {node: '>=18'} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.0: - resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -2985,8 +2990,8 @@ packages: fast-string-width@1.1.0: resolution: {integrity: sha512-O3fwIVIH5gKB38QNbdg+3760ZmGz0SZMgvwJbA1b2TGXceKE6A2cOlfogh1iw8lr049zPyd7YADHy+B7U4W9bQ==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@4.2.2: + resolution: {integrity: sha512-EwVpUMzLVNOmcWW0zi5G3JJwkopB6XXjnVvNBGfqrMMsVew2hkQWl5e/pe/CfYUeS6jt4cIO2MnamEW7v/7wPw==} fast-wrap-ansi@0.1.6: resolution: {integrity: sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w==} @@ -3525,12 +3530,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.14.2: - resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsesc@3.1.0: @@ -4489,8 +4494,8 @@ packages: property-information@7.2.0: resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} proxy-from-env@2.1.0: @@ -4943,11 +4948,11 @@ packages: resolution: {integrity: sha512-eCPu1qRxPVkl5605OTWF8Wz40b4Mf45NY5LQmVPQ599knfs5QhASUm9GbJ5BDMDOXgrnh0wyEdvzmL//YMlw0A==} engines: {node: '>=18'} - stream-chain@3.6.1: - resolution: {integrity: sha512-M4BQpNPI71uumkVXjl4y+mIormQXdo4R0pSR23mcLbn6D+kpvu7Kx2g1hf0jRB76Zb1IT1M06OIGghMTAtZdyQ==} + stream-chain@4.2.6: + resolution: {integrity: sha512-1zeJ8CrtJfmiba26ui8jXkq/xLRFvhzkdH02D5QLO9Cnovgeb28IJxg88DdraWnjnkbOol/++uIAybJbJhk7ig==} - stream-json@2.1.0: - resolution: {integrity: sha512-9gV/ywtebMn3DdKnNKYCb9iESvgR1dHbucNV+bRGvdvy+jV4c9FFgYKmENhpKv58jSwvs90Wk80RhfKk1KxHPg==} + stream-json@3.7.0: + resolution: {integrity: sha512-rCSBdcBP/bPk6T8QFcxAj1MSzAuc5i49cYW6IE7sYObNEPccBJIUiL6fU9c9BWt40aJK0siVynLX7lWaW8alXw==} string-argv@0.3.1: resolution: {integrity: sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==} @@ -5859,7 +5864,7 @@ snapshots: hast-util-from-html: 2.0.3 hast-util-to-text: 4.0.2 import-meta-resolve: 4.2.0 - js-yaml: 4.2.0 + js-yaml: 4.3.2 mdast-util-definitions: 6.0.0 rehype-raw: 7.0.0 rehype-stringify: 10.0.1 @@ -6174,7 +6179,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.2.0 + js-yaml: 4.3.2 '@changesets/pre@2.0.2': dependencies: @@ -6998,7 +7003,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.14.2 + js-yaml: 3.15.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -7672,7 +7677,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 4.2.2 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -7776,7 +7781,7 @@ snapshots: html-escaper: 3.0.3 http-cache-semantics: 4.3.0 import-meta-resolve: 4.2.0 - js-yaml: 4.2.0 + js-yaml: 4.3.2 magic-string: 0.30.21 magicast: 0.5.5 mrmime: 2.0.1 @@ -7849,7 +7854,7 @@ snapshots: atomic-sleep@1.0.0: {} - axios@1.18.0: + axios@1.20.0: dependencies: follow-redirects: 1.16.0 form-data: 4.0.6 @@ -7916,12 +7921,12 @@ snapshots: widest-line: 5.0.0 wrap-ansi: 9.0.2 - brace-expansion@1.1.14: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.0: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 @@ -8188,7 +8193,7 @@ snapshots: cosmiconfig@8.3.6(typescript@5.7.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.2 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -8578,7 +8583,7 @@ snapshots: on-finished: 2.4.1 parseurl: 1.3.3 path-to-regexp: 0.1.13 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.14.2 range-parser: 1.2.1 safe-buffer: 5.2.1 @@ -8626,7 +8631,7 @@ snapshots: dependencies: fast-string-truncated-width: 1.2.1 - fast-uri@3.1.2: {} + fast-uri@4.2.2: {} fast-wrap-ansi@0.1.6: dependencies: @@ -9181,12 +9186,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.14.2: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.2.0: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -9260,7 +9265,7 @@ snapshots: fast-glob: 3.3.2 globby: 13.2.2 jiti: 1.21.0 - js-yaml: 4.2.0 + js-yaml: 4.3.2 micromatch: 4.0.8 minimist: 1.2.8 pretty-ms: 8.0.0 @@ -9803,11 +9808,11 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.21 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.7 minimist-options@4.1.0: dependencies: @@ -9834,7 +9839,7 @@ snapshots: glob: 10.5.0 he: 1.2.0 is-path-inside: 3.0.3 - js-yaml: 4.2.0 + js-yaml: 4.3.2 log-symbols: 4.1.0 minimatch: 9.0.9 ms: 2.1.3 @@ -10361,7 +10366,7 @@ snapshots: property-information@7.2.0: {} - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -10423,7 +10428,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.14.2 + js-yaml: 3.15.2 pify: 4.0.1 strip-bom: 3.0.0 @@ -10940,11 +10945,11 @@ snapshots: stdin-discarder@0.3.2: {} - stream-chain@3.6.1: {} + stream-chain@4.2.6: {} - stream-json@2.1.0: + stream-json@3.7.0: dependencies: - stream-chain: 3.6.1 + stream-chain: 4.2.6 string-argv@0.3.1: {} diff --git a/src/services/event-import-service.ts b/src/services/event-import-service.ts index 68f8cdf76..460ac4de9 100644 --- a/src/services/event-import-service.ts +++ b/src/services/event-import-service.ts @@ -1,9 +1,10 @@ import fs from 'fs' import readline from 'readline' -const streamArray = require('stream-json/streamers/stream-array.js') as { - withParserAsStream: () => NodeJS.ReadWriteStream +const streamArrayModule = require('stream-json/streamers/stream-array.js') as { + default: { withParserAsStream: () => NodeJS.ReadWriteStream } } +const streamArray = streamArrayModule.default import { getEventExpiration, diff --git a/website/hero-animation/package.json b/website/hero-animation/package.json index 0c008bc52..1b6b453aa 100644 --- a/website/hero-animation/package.json +++ b/website/hero-animation/package.json @@ -31,6 +31,9 @@ "typescript": "^5.8.3" }, "pnpm": { + "overrides": { + "ip@<=2.0.1": "npm:@stdlib/utils-noop@^0.2.3" + }, "onlyBuiltDependencies": [ "esbuild", "node-av", diff --git a/website/hero-animation/pnpm-lock.yaml b/website/hero-animation/pnpm-lock.yaml index 15b070c38..84d131f22 100644 --- a/website/hero-animation/pnpm-lock.yaml +++ b/website/hero-animation/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + ip@<=2.0.1: npm:@stdlib/utils-noop@^0.2.3 + importers: .: @@ -647,6 +650,11 @@ packages: '@shinyoshiaki/jspack@0.0.6': resolution: {integrity: sha512-SdsNhLjQh4onBlyPrn4ia1Pdx5bXT88G/LIEpOYAjx2u4xeY/m/HB5yHqlkJB1uQR3Zw4R3hBWLj46STRAN0rg==} + '@stdlib/utils-noop@0.2.3': + resolution: {integrity: sha512-kZQWwUwq+RwmKBZZD+6dnRwhjfut5fBgbEappugvVjFGp12wDKXCj6D6Y/xTmBdKFRumO8/gzkj9n6DKNDchpA==} + engines: {node: '>=0.10.0', npm: '>2.7.0'} + os: [aix, darwin, freebsd, linux, macos, openbsd, sunos, win32, windows] + '@swc/helpers@0.5.23': resolution: {integrity: sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==} @@ -871,9 +879,6 @@ packages: resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==} engines: {node: '>=12'} - ip@2.0.1: - resolution: {integrity: sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==} - is-plain-object@2.0.4: resolution: {integrity: sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==} engines: {node: '>=0.10.0'} @@ -1580,6 +1585,9 @@ snapshots: '@shinyoshiaki/jspack@0.0.6': optional: true + '@stdlib/utils-noop@0.2.3': + optional: true + '@swc/helpers@0.5.23': dependencies: tslib: 2.8.1 @@ -1841,9 +1849,6 @@ snapshots: internmap@2.0.3: {} - ip@2.0.1: - optional: true - is-plain-object@2.0.4: dependencies: isobject: 3.0.1 @@ -2161,7 +2166,7 @@ snapshots: debug: 4.4.0 fast-deep-equal: 3.1.3 int64-buffer: 1.1.0 - ip: 2.0.1 + ip: '@stdlib/utils-noop@0.2.3' mp4box: 0.5.4 multicast-dns: 7.2.5 tweetnacl: 1.0.3 From 7167e4393a59655e472f9de386822764c2534977 Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Thu, 15 Oct 2026 22:47:04 -0400 Subject: [PATCH 2/2] ci(website): keep manual deploys main-only Greptile P1 on #838: the release-trigger move dropped main's old workflow_dispatch guard, so a manual run from any branch would build the selected ref and wrangler-deploy it to production. Restore the guard: dispatch requires github.ref == refs/heads/main; release runs are unaffected (their ref is the website tag, admitted by the tag_name check). Coordinated with #837, which pins the release checkout to refs/heads/main for the environment's branch policy. --- .github/workflows/deploy-website.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml index f4eda8172..0effa158f 100644 --- a/.github/workflows/deploy-website.yml +++ b/.github/workflows/deploy-website.yml @@ -18,9 +18,11 @@ concurrency: jobs: deploy: + # workflow_dispatch ignores every on: filter — a manual run must not + # publish a non-main branch to production, so dispatch stays main-only. if: >- ${{ startsWith(github.event.release.tag_name, 'nostream-website@') || - github.event_name == 'workflow_dispatch' }} + (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }} name: Build and deploy to Cloudflare Workers runs-on: ubuntu-latest # Deploy credentials live in this GitHub environment: CLOUDFLARE_API_TOKEN