From 598131bd3968b913e33b8ac761cc2dd2f6f3ccc6 Mon Sep 17 00:00:00 2001 From: Yos Riady Date: Thu, 1 Oct 2026 09:52:35 +0700 Subject: [PATCH] fix(security): patch Aikido-flagged dependencies Raise same-major overrides so the lockfiles resolve patched versions. Root (dev-only, jest transitive): brace-expansion 5.0.12, js-yaml 3.15.2, browserslist 4.29.0, baseline-browser-mapping 2.11.25. .deepsec (scanner workspace): undici 7.30.0, proxy-addr 2.0.8, ip-address 10.7.2, brace-expansion 5.0.12, fast-uri 3.1.8, hono 4.13.12, qs 6.16.0. Overrides are kept in sync in package.json and pnpm-workspace.yaml. pnpm audit: root 9 to 0, .deepsec 32 to 0. Co-Authored-By: Claude Opus 5.5 (1M context) --- .deepsec/package.json | 14 ++++--- .deepsec/pnpm-lock.yaml | 80 ++++++++++++++++++------------------ .deepsec/pnpm-workspace.yaml | 12 +++--- pnpm-lock.yaml | 75 +++++++++++++++++---------------- pnpm-workspace.yaml | 11 +++-- 5 files changed, 102 insertions(+), 90 deletions(-) diff --git a/.deepsec/package.json b/.deepsec/package.json index 9249e61..0dd982c 100644 --- a/.deepsec/package.json +++ b/.deepsec/package.json @@ -11,15 +11,17 @@ }, "pnpm": { "overrides": { - "fast-uri": ">=3.1.4 <4", - "hono": ">=4.12.27 <5", + "fast-uri": ">=3.1.8 <4", + "hono": ">=4.13.7 <5", "@hono/node-server": ">=2.0.5 <3", - "undici": ">=7.28.0 <8", + "undici": ">=7.29.1 <8", "tar": ">=7.5.21 <8", - "qs": ">=6.15.2 <7", + "qs": ">=6.16.0 <7", "body-parser": ">=2.3.0 <3", - "brace-expansion@>=3": ">=5.0.8 <6", - "zod": ">=4.4.0 <5" + "brace-expansion@>=3": ">=5.0.12 <6", + "zod": ">=4.4.0 <5", + "ip-address": ">=10.7.1 <11", + "proxy-addr": ">=2.0.8 <3" } }, "dependencies": { diff --git a/.deepsec/pnpm-lock.yaml b/.deepsec/pnpm-lock.yaml index 409ae39..112b366 100644 --- a/.deepsec/pnpm-lock.yaml +++ b/.deepsec/pnpm-lock.yaml @@ -5,15 +5,17 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri: '>=3.1.4 <4' - hono: '>=4.12.27 <5' + fast-uri: '>=3.1.8 <4' + hono: '>=4.13.7 <5' '@hono/node-server': '>=2.0.5 <3' - undici: '>=7.28.0 <8' + undici: '>=7.29.1 <8' tar: '>=7.5.21 <8' - qs: '>=6.15.2 <7' + qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - brace-expansion@>=3: '>=5.0.8 <6' + brace-expansion@>=3: '>=5.0.12 <6' zod: '>=4.4.0 <5' + ip-address: '>=10.7.1 <11' + proxy-addr: '>=2.0.8 <3' importers: @@ -223,7 +225,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: '>=4.12.27 <5' + hono: '>=4.13.7 <5' '@isaacs/fs-minipass@4.0.1': resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} @@ -508,8 +510,8 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} buffer-equal-constant-time@1.0.1: @@ -651,8 +653,8 @@ packages: fast-fifo@1.3.2: resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fetch-blob@3.2.0: resolution: {integrity: sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==} @@ -727,8 +729,8 @@ packages: highlight.js@10.7.3: resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.12: + resolution: {integrity: sha512-6E2QDAc9Ick9Sq77ZrGS/dk2WUYni91aufTw6LJKpV7w8kW5/GxVUc650FOADOmlwg3K+f7Pun6XlV+pYmW6gw==} engines: {node: '>=16.9.0'} hosted-git-info@9.0.3: @@ -758,8 +760,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.7.2: + resolution: {integrity: sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -928,12 +930,12 @@ packages: resolution: {integrity: sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==} engines: {node: '>=12.0.0'} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} range-parser@1.2.1: @@ -1046,8 +1048,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} unpipe@1.0.0: @@ -1429,7 +1431,7 @@ snapshots: proper-lockfile: 4.1.2 semver: 7.8.0 typebox: 1.1.38 - undici: 7.29.0 + undici: 7.30.0 yaml: 2.9.0 optionalDependencies: '@mariozechner/clipboard': 0.3.9 @@ -1459,9 +1461,9 @@ snapshots: - supports-color - utf-8-validate - '@hono/node-server@2.0.12(hono@4.12.34)': + '@hono/node-server@2.0.12(hono@4.13.12)': dependencies: - hono: 4.12.34 + hono: 4.13.12 '@isaacs/fs-minipass@4.0.1': dependencies: @@ -1525,7 +1527,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.34) + '@hono/node-server': 2.0.12(hono@4.13.12) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -1535,7 +1537,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.34 + hono: 4.13.12 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -1674,7 +1676,7 @@ snapshots: ms: 2.1.3 picocolors: 1.1.1 tar-stream: 3.1.7 - undici: 7.29.0 + undici: 7.30.0 xdg-app-paths: 5.1.0 zod: 4.4.3 transitivePeerDependencies: @@ -1697,7 +1699,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1723,7 +1725,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.2 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -1731,7 +1733,7 @@ snapshots: bowser@2.14.1: {} - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -1847,7 +1849,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.2.0 + ip-address: 10.7.2 express@5.2.1: dependencies: @@ -1870,8 +1872,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.15.3 + proxy-addr: 2.0.8 + qs: 6.16.0 range-parser: 1.2.1 router: 2.2.0 send: 1.2.1 @@ -1888,7 +1890,7 @@ snapshots: fast-fifo@1.3.2: {} - fast-uri@3.1.5: {} + fast-uri@3.1.8: {} fetch-blob@3.2.0: dependencies: @@ -1983,7 +1985,7 @@ snapshots: highlight.js@10.7.3: {} - hono@4.12.34: {} + hono@4.13.12: {} hosted-git-info@9.0.3: dependencies: @@ -2019,7 +2021,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.2.0: {} + ip-address@10.7.2: {} ipaddr.js@1.9.1: {} @@ -2077,7 +2079,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -2158,12 +2160,12 @@ snapshots: '@types/node': 26.1.2 long: 5.3.2 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 - qs@6.15.3: + qs@6.16.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -2312,7 +2314,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.29.0: {} + undici@7.30.0: {} unpipe@1.0.0: {} diff --git a/.deepsec/pnpm-workspace.yaml b/.deepsec/pnpm-workspace.yaml index 710874a..a27b7a9 100644 --- a/.deepsec/pnpm-workspace.yaml +++ b/.deepsec/pnpm-workspace.yaml @@ -4,14 +4,16 @@ packages: [] # packageManager) reads the identical copy in package.json#pnpm.overrides. # KEEP THE TWO IN SYNC. overrides: - fast-uri: '>=3.1.4 <4' - hono: '>=4.12.27 <5' + fast-uri: '>=3.1.8 <4' + hono: '>=4.13.7 <5' '@hono/node-server': '>=2.0.5 <3' - undici: '>=7.28.0 <8' + undici: '>=7.29.1 <8' tar: '>=7.5.21 <8' - qs: '>=6.15.2 <7' + qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - 'brace-expansion@>=3': '>=5.0.8 <6' + 'brace-expansion@>=3': '>=5.0.12 <6' # @vercel/sandbox pins zod exactly 3.24.4 (in Aikido's vulnerable <4.4.0 # range); forced major is accepted for this scanner-only workspace. zod: '>=4.4.0 <5' + ip-address: '>=10.7.1 <11' + proxy-addr: '>=2.0.8 <3' diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 452002a..3e8ad33 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,10 +6,12 @@ settings: overrides: test-exclude: ^8.0.0 - brace-expansion: ^5.0.8 + brace-expansion: ^5.0.12 minimatch: ^9.0.7 || ^10.2.3 - js-yaml@3: '>=3.15.0 <4' + js-yaml@3: '>=3.15.2 <4' '@babel/core': '>=7.29.6 <8' + browserslist@4: '>=4.28.7 <5' + baseline-browser-mapping@2: '>=2.11.0 <3' importers: @@ -698,17 +700,17 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - baseline-browser-mapping@2.10.29: - resolution: {integrity: sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==} + baseline-browser-mapping@2.11.25: + resolution: {integrity: sha512-gMmEShwwq7FJqMwvfRwvCl00v4kN+KOfJqXn+f4nrufak5gNHJOksd/60Dvjuz7sI8Y5WiSFBa8FEYr+zoyqCw==} engines: {node: '>=6.0.0'} hasBin: true - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} - browserslist@4.28.2: - resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} + browserslist@4.29.0: + resolution: {integrity: sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -730,8 +732,8 @@ packages: resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==} engines: {node: '>=10'} - caniuse-lite@1.0.30001792: - resolution: {integrity: sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} chalk@4.1.2: resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==} @@ -801,8 +803,8 @@ packages: eastasianwidth@0.2.0: resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==} - electron-to-chromium@1.5.356: - resolution: {integrity: sha512-9NgFd7m5t5MCJ5rUSjJITUXAH9mEGlrlofnMf4YEr+pz6JlP7cWmTAH+JFmbPnaSW8koVTkuW7pacORWAnA5Yw==} + electron-to-chromium@1.5.438: + resolution: {integrity: sha512-AN9xMU1hJiT65LkCUPL1DZm5TCbOPb2Qsm5pYwFLEXp6/qj9SdT4yMiqs7Qqstwvkn1zF7l36SRGt+s6XcJ0FA==} emittery@0.13.1: resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==} @@ -1085,8 +1087,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true jsesc@3.1.0: @@ -1162,8 +1164,9 @@ packages: node-int64@0.4.0: resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==} - node-releases@2.0.44: - resolution: {integrity: sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==} + node-releases@2.0.57: + resolution: {integrity: sha512-kQK9LGGFiHtrWiNhZtA7Qbw17AQz+dmsEKODRIVTXA9+e5MS/2gZEBhYJt13GrAz5/IOZKddH/0Z3TP/Zgo+yw==} + engines: {node: '>=18'} normalize-path@3.0.0: resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==} @@ -1375,11 +1378,11 @@ packages: unrs-resolver@1.11.1: resolution: {integrity: sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} + update-browserslist-db@1.3.3: + resolution: {integrity: sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: '>=4.28.7 <5' v8-to-istanbul@9.3.0: resolution: {integrity: sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==} @@ -1480,7 +1483,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.2 + browserslist: 4.29.0 lru-cache: 5.1.1 semver: 6.3.1 @@ -1672,7 +1675,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.0 + js-yaml: 3.15.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -2181,19 +2184,19 @@ snapshots: balanced-match@4.0.4: {} - baseline-browser-mapping@2.10.29: {} + baseline-browser-mapping@2.11.25: {} - brace-expansion@5.0.8: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 - browserslist@4.28.2: + browserslist@4.29.0: dependencies: - baseline-browser-mapping: 2.10.29 - caniuse-lite: 1.0.30001792 - electron-to-chromium: 1.5.356 - node-releases: 2.0.44 - update-browserslist-db: 1.2.3(browserslist@4.28.2) + baseline-browser-mapping: 2.11.25 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.438 + node-releases: 2.0.57 + update-browserslist-db: 1.3.3(browserslist@4.29.0) bser@2.1.1: dependencies: @@ -2207,7 +2210,7 @@ snapshots: camelcase@6.3.0: {} - caniuse-lite@1.0.30001792: {} + caniuse-lite@1.0.30001810: {} chalk@4.1.2: dependencies: @@ -2256,7 +2259,7 @@ snapshots: eastasianwidth@0.2.0: {} - electron-to-chromium@1.5.356: {} + electron-to-chromium@1.5.438: {} emittery@0.13.1: {} @@ -2722,7 +2725,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.0: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 @@ -2765,7 +2768,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -2777,7 +2780,7 @@ snapshots: node-int64@0.4.0: {} - node-releases@2.0.44: {} + node-releases@2.0.57: {} normalize-path@3.0.0: {} @@ -2974,9 +2977,9 @@ snapshots: '@unrs/resolver-binding-win32-ia32-msvc': 1.11.1 '@unrs/resolver-binding-win32-x64-msvc': 1.11.1 - update-browserslist-db@1.2.3(browserslist@4.28.2): + update-browserslist-db@1.3.3(browserslist@4.29.0): dependencies: - browserslist: 4.28.2 + browserslist: 4.29.0 escalade: 3.2.0 picocolors: 1.1.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2ce43eb..c139d5b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -24,10 +24,13 @@ allowBuilds: # does not read — pnpm uses this `overrides` field instead). overrides: test-exclude: ^8.0.0 - # brace-expansion <5.0.8: CVE-2026-13149 / CVE-2026-14257 - brace-expansion: ^5.0.8 + # brace-expansion <5.0.12: CVE-2026-13149 / CVE-2026-14257 plus later 5.0.x advisories + brace-expansion: ^5.0.12 minimatch: ^9.0.7 || ^10.2.3 - # js-yaml 3.x <3.15.0: CVE-2026-59869 / CVE-2026-53550 (jest/@swc transitive) - 'js-yaml@3': '>=3.15.0 <4' + # js-yaml 3.x <3.15.2: CVE-2026-59869 / CVE-2026-53550 plus later 3.15.x advisories (jest/@swc transitive) + 'js-yaml@3': '>=3.15.2 <4' # @babel/core <=7.29.0: CVE-2026-49356 (jest transitive, dev-only) '@babel/core': '>=7.29.6 <8' + # browserslist <=4.28.6 and baseline-browser-mapping <2.11.0 (jest > @babel/core transitive, dev-only) + 'browserslist@4': '>=4.28.7 <5' + 'baseline-browser-mapping@2': '>=2.11.0 <3'