diff --git a/.deepsec/package.json b/.deepsec/package.json index 9249e61..8eb1e73 100644 --- a/.deepsec/package.json +++ b/.deepsec/package.json @@ -11,14 +11,15 @@ }, "pnpm": { "overrides": { - "fast-uri": ">=3.1.4 <4", - "hono": ">=4.12.27 <5", + "fast-uri": ">=3.1.6 <4", + "hono": ">=4.13.5 <5", + "ip-address": ">=10.3.1 <11", "@hono/node-server": ">=2.0.5 <3", "undici": ">=7.28.0 <8", "tar": ">=7.5.21 <8", - "qs": ">=6.15.2 <7", + "qs": ">=6.16.0 <7", "body-parser": ">=2.3.0 <3", - "brace-expansion@>=3": ">=5.0.8 <6", + "brace-expansion@>=3": ">=5.0.9 <6", "zod": ">=4.4.0 <5" } }, diff --git a/.deepsec/pnpm-lock.yaml b/.deepsec/pnpm-lock.yaml index 409ae39..d6b816a 100644 --- a/.deepsec/pnpm-lock.yaml +++ b/.deepsec/pnpm-lock.yaml @@ -5,14 +5,15 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri: '>=3.1.4 <4' - hono: '>=4.12.27 <5' + fast-uri: '>=3.1.6 <4' + hono: '>=4.13.5 <5' + ip-address: '>=10.3.1 <11' '@hono/node-server': '>=2.0.5 <3' undici: '>=7.28.0 <8' tar: '>=7.5.21 <8' - qs: '>=6.15.2 <7' + qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - brace-expansion@>=3: '>=5.0.8 <6' + brace-expansion@>=3: '>=5.0.9 <6' zod: '>=4.4.0 <5' importers: @@ -111,6 +112,9 @@ packages: '@aws-sdk/core@3.977.4': resolution: {integrity: sha512-CEkcQlMOQJCvul60U7wdAOACjtdgFWDsfJI+6wUOGdhGNV2lGbuJpi/R50QLpFG3Tp+sQxa/RmzC3X7KHbhuTA==} engines: {node: '>=20.0.0'} + deprecated: |- + Deprecated due to Document number parsing bug in JSON, see + https://github.com/aws/aws-sdk-js-v3/issues/8246. Newer version available. '@aws-sdk/credential-provider-env@3.972.65': resolution: {integrity: sha512-lJT2aRw9wCV8jPHyFJjdZLD4HTydL6/22AnCSOB8e/LqOc55nEJGLHkJQeSxhn8QiqyjFwPKQFtMw0ovjRUY/g==} @@ -223,7 +227,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: '>=4.12.27 <5' + hono: '>=4.13.5 <5' '@isaacs/fs-minipass@4.0.1': resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} @@ -651,8 +655,8 @@ packages: fast-fifo@1.3.2: resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} fetch-blob@3.2.0: resolution: {integrity: sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==} @@ -727,8 +731,8 @@ packages: highlight.js@10.7.3: resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.7: + resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==} engines: {node: '>=16.9.0'} hosted-git-info@9.0.3: @@ -758,8 +762,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.7.0: + resolution: {integrity: sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -932,8 +936,8 @@ packages: resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} engines: {node: '>= 0.10'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} range-parser@1.2.1: @@ -1459,9 +1463,9 @@ snapshots: - supports-color - utf-8-validate - '@hono/node-server@2.0.12(hono@4.12.34)': + '@hono/node-server@2.0.12(hono@4.13.7)': dependencies: - hono: 4.12.34 + hono: 4.13.7 '@isaacs/fs-minipass@4.0.1': dependencies: @@ -1525,7 +1529,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.34) + '@hono/node-server': 2.0.12(hono@4.13.7) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -1535,7 +1539,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.34 + hono: 4.13.7 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -1697,7 +1701,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1723,7 +1727,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.2 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -1847,7 +1851,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.2.0 + ip-address: 10.7.0 express@5.2.1: dependencies: @@ -1871,7 +1875,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.7 - qs: 6.15.3 + qs: 6.16.0 range-parser: 1.2.1 router: 2.2.0 send: 1.2.1 @@ -1888,7 +1892,7 @@ snapshots: fast-fifo@1.3.2: {} - fast-uri@3.1.5: {} + fast-uri@3.1.7: {} fetch-blob@3.2.0: dependencies: @@ -1983,7 +1987,7 @@ snapshots: highlight.js@10.7.3: {} - hono@4.12.34: {} + hono@4.13.7: {} hosted-git-info@9.0.3: dependencies: @@ -2019,7 +2023,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.2.0: {} + ip-address@10.7.0: {} ipaddr.js@1.9.1: {} @@ -2163,7 +2167,7 @@ snapshots: forwarded: 0.2.0 ipaddr.js: 1.9.1 - qs@6.15.3: + qs@6.16.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 diff --git a/.deepsec/pnpm-workspace.yaml b/.deepsec/pnpm-workspace.yaml index 710874a..bf1b98b 100644 --- a/.deepsec/pnpm-workspace.yaml +++ b/.deepsec/pnpm-workspace.yaml @@ -4,14 +4,15 @@ packages: [] # packageManager) reads the identical copy in package.json#pnpm.overrides. # KEEP THE TWO IN SYNC. overrides: - fast-uri: '>=3.1.4 <4' - hono: '>=4.12.27 <5' + fast-uri: '>=3.1.6 <4' + hono: '>=4.13.5 <5' + ip-address: '>=10.3.1 <11' '@hono/node-server': '>=2.0.5 <3' undici: '>=7.28.0 <8' tar: '>=7.5.21 <8' - qs: '>=6.15.2 <7' + qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - 'brace-expansion@>=3': '>=5.0.8 <6' + 'brace-expansion@>=3': '>=5.0.9 <6' # @vercel/sandbox pins zod exactly 3.24.4 (in Aikido's vulnerable <4.4.0 # range); forced major is accepted for this scanner-only workspace. zod: '>=4.4.0 <5' diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7624d33..4d2d606 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,16 +9,18 @@ overrides: '@react-native-community/cli': '>=17.0.1' '@react-native-community/cli-server-api': '>=17.0.1' '@ungap/structured-clone': '>=1.3.1' - '@xmldom/xmldom': '>=0.9.10' - brace-expansion@1: '>=1.1.13 <2' - brace-expansion@2: '>=2.0.3 <3' - brace-expansion@5: '>=5.0.6 <6' + '@xmldom/xmldom': '>=0.9.12' + brace-expansion@1: '>=1.1.18 <2' + brace-expansion@2: '>=2.1.4 <3' + brace-expansion@5: '>=5.0.9 <6' fast-xml-parser: '>=4.5.5' - js-yaml@3: '>=3.15.0 <4' + js-yaml@3: '>=3.15.2 <4' + js-yaml@4: '>=4.3.2 <5' minimatch@3: '>=3.1.5 <4' minimatch@5: '>=5.1.9 <6' minimatch@9: '>=9.0.9 <10' minimatch@10: '>=10.2.4' + nanoid@3: '>=3.3.18 <4' node-forge: '>=1.4.0' picomatch@2: '>=2.3.2 <3' picomatch@3: '>=3.0.2 <4' @@ -2148,8 +2150,8 @@ packages: typescript: optional: true - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} abitype@1.2.3: @@ -2368,15 +2370,15 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.16: - resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -3293,12 +3295,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsc-safe-url@0.2.4: @@ -3616,8 +3618,8 @@ packages: multitars@1.0.0: resolution: {integrity: sha512-H/J4fMLedtudftaYMOg7ajzLYgT3/rwbWVJbqr/iUgB8DQztn38ys5HOqI1CzSxx8QhXXwOOnnBvd4v3jG5+Mg==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -6220,7 +6222,7 @@ snapshots: '@expo/plist@0.8.1': dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 15.1.1 @@ -6279,7 +6281,7 @@ snapshots: dependencies: '@babel/code-frame': 7.29.7 chalk: 4.1.2 - js-yaml: 4.3.0 + js-yaml: 4.3.2 '@humanfs/core@0.19.2': dependencies: @@ -6313,7 +6315,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.0 + js-yaml: 3.15.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -7065,7 +7067,7 @@ snapshots: - react - use-sync-external-store - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} abitype@1.2.3(typescript@6.0.3)(zod@4.4.3): optionalDependencies: @@ -7340,16 +7342,16 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.16: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.7: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -8449,12 +8451,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.0: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.0: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -8800,15 +8802,15 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.9 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.16 + brace-expansion: 1.1.18 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.2 + brace-expansion: 2.1.4 minipass@7.1.3: {} @@ -8824,7 +8826,7 @@ snapshots: multitars@1.0.0: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} napi-postinstall@0.3.4: {} @@ -8992,7 +8994,7 @@ snapshots: plist@3.1.1: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 base64-js: 1.5.1 xmlbuilder: 15.1.1 @@ -9000,7 +9002,7 @@ snapshots: postcss@8.5.23: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 0ad8a57..8526196 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -39,19 +39,21 @@ overrides: '@react-native-community/cli': '>=17.0.1' '@react-native-community/cli-server-api': '>=17.0.1' '@ungap/structured-clone': '>=1.3.1' - '@xmldom/xmldom': '>=0.9.10' - 'brace-expansion@1': '>=1.1.13 <2' - 'brace-expansion@2': '>=2.0.3 <3' - 'brace-expansion@5': '>=5.0.6 <6' + '@xmldom/xmldom': '>=0.9.12' + 'brace-expansion@1': '>=1.1.18 <2' + 'brace-expansion@2': '>=2.1.4 <3' + 'brace-expansion@5': '>=5.0.9 <6' 'fast-xml-parser': '>=4.5.5' # Cap at <4: uncapped this resolved to js-yaml 5.2.1, which is itself - # vulnerable (GHSA-pm4m-ph32-ghv5, fixed in 5.2.2). 3.15.0 patches the 3.x + # vulnerable (GHSA-pm4m-ph32-ghv5, fixed in 5.2.2). 3.15.2 patches the 3.x # advisories while keeping the safeLoad-era API the dependents expect. - 'js-yaml@3': '>=3.15.0 <4' + 'js-yaml@3': '>=3.15.2 <4' + 'js-yaml@4': '>=4.3.2 <5' 'minimatch@3': '>=3.1.5 <4' 'minimatch@5': '>=5.1.9 <6' 'minimatch@9': '>=9.0.9 <10' 'minimatch@10': '>=10.2.4' + 'nanoid@3': '>=3.3.18 <4' 'node-forge': '>=1.4.0' 'picomatch@2': '>=2.3.2 <3' 'picomatch@3': '>=3.0.2 <4' @@ -80,11 +82,8 @@ overrides: # Audit policy: ignore advisories that only affect react-native's / wagmi's BUILD # tooling (never shipped in the SDK's runtime) and that cannot be cleanly patched. -# The overrides above already bump the fixable instances (shell-quote, tmp, ws@6/7, -# most ws@8, js-yaml@3); these residuals have no non-breaking fix available: -# GHSA-4x5r-pxfx-6jf8 @babel/core (LOW) no patched version published (>=7.29.1 absent) -# GHSA-96hv-2xvq-fx4p ws (HIGH) one build-tooling ws@8.20.1 resists the >=8.21.0 override -# GHSA-h67p-54hq-rp68 js-yaml (MODERATE) the only 4.x fix is a breaking major bump (5.x) +# The overrides above bump every fixable instance. These residuals have no +# published fix available: # GHSA-w3rx-r6r6-pgpr image-size (HIGH) no patched version published (see below) # GHSA-5p2g-fcmc-qvqq image-size (HIGH) no patched version published (see below) # @@ -100,8 +99,5 @@ overrides: # Revisit as upstream (react-native / metro / viem) updates these transitive deps. auditConfig: ignoreGhsas: - - GHSA-4x5r-pxfx-6jf8 - - GHSA-96hv-2xvq-fx4p - - GHSA-h67p-54hq-rp68 - GHSA-w3rx-r6r6-pgpr - GHSA-5p2g-fcmc-qvqq