diff --git a/.deepsec/package.json b/.deepsec/package.json index 8eb1e73..ae760b4 100644 --- a/.deepsec/package.json +++ b/.deepsec/package.json @@ -11,15 +11,15 @@ }, "pnpm": { "overrides": { - "fast-uri": ">=3.1.6 <4", + "fast-uri": ">=3.1.8 <4", "hono": ">=4.13.5 <5", - "ip-address": ">=10.3.1 <11", + "ip-address": ">=10.7.1 <11", "@hono/node-server": ">=2.0.5 <3", - "undici": ">=7.28.0 <8", + "undici": ">=7.29.1 <8", "tar": ">=7.5.21 <8", "qs": ">=6.16.0 <7", "body-parser": ">=2.3.0 <3", - "brace-expansion@>=3": ">=5.0.9 <6", + "brace-expansion@>=3": ">=5.0.12 <6", "zod": ">=4.4.0 <5" } }, diff --git a/.deepsec/pnpm-lock.yaml b/.deepsec/pnpm-lock.yaml index d6b816a..a674462 100644 --- a/.deepsec/pnpm-lock.yaml +++ b/.deepsec/pnpm-lock.yaml @@ -5,15 +5,15 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri: '>=3.1.6 <4' + fast-uri: '>=3.1.8 <4' hono: '>=4.13.5 <5' - ip-address: '>=10.3.1 <11' + ip-address: '>=10.7.1 <11' '@hono/node-server': '>=2.0.5 <3' - undici: '>=7.28.0 <8' + undici: '>=7.29.1 <8' tar: '>=7.5.21 <8' qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - brace-expansion@>=3: '>=5.0.9 <6' + brace-expansion@>=3: '>=5.0.12 <6' zod: '>=4.4.0 <5' importers: @@ -512,8 +512,8 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} buffer-equal-constant-time@1.0.1: @@ -655,8 +655,8 @@ packages: fast-fifo@1.3.2: resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fetch-blob@3.2.0: resolution: {integrity: sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==} @@ -762,8 +762,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.7.0: - resolution: {integrity: sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==} + ip-address@10.7.2: + resolution: {integrity: sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -1050,8 +1050,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} unpipe@1.0.0: @@ -1433,7 +1433,7 @@ snapshots: proper-lockfile: 4.1.2 semver: 7.8.0 typebox: 1.1.38 - undici: 7.29.0 + undici: 7.30.0 yaml: 2.9.0 optionalDependencies: '@mariozechner/clipboard': 0.3.9 @@ -1678,7 +1678,7 @@ snapshots: ms: 2.1.3 picocolors: 1.1.1 tar-stream: 3.1.7 - undici: 7.29.0 + undici: 7.30.0 xdg-app-paths: 5.1.0 zod: 4.4.3 transitivePeerDependencies: @@ -1701,7 +1701,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1735,7 +1735,7 @@ snapshots: bowser@2.14.1: {} - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -1851,7 +1851,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.7.0 + ip-address: 10.7.2 express@5.2.1: dependencies: @@ -1892,7 +1892,7 @@ snapshots: fast-fifo@1.3.2: {} - fast-uri@3.1.7: {} + fast-uri@3.1.8: {} fetch-blob@3.2.0: dependencies: @@ -2023,7 +2023,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.7.0: {} + ip-address@10.7.2: {} ipaddr.js@1.9.1: {} @@ -2081,7 +2081,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -2316,7 +2316,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.29.0: {} + undici@7.30.0: {} unpipe@1.0.0: {} diff --git a/.deepsec/pnpm-workspace.yaml b/.deepsec/pnpm-workspace.yaml index bf1b98b..6055119 100644 --- a/.deepsec/pnpm-workspace.yaml +++ b/.deepsec/pnpm-workspace.yaml @@ -4,15 +4,15 @@ packages: [] # packageManager) reads the identical copy in package.json#pnpm.overrides. # KEEP THE TWO IN SYNC. overrides: - fast-uri: '>=3.1.6 <4' + fast-uri: '>=3.1.8 <4' hono: '>=4.13.5 <5' - ip-address: '>=10.3.1 <11' + ip-address: '>=10.7.1 <11' '@hono/node-server': '>=2.0.5 <3' - undici: '>=7.28.0 <8' + undici: '>=7.29.1 <8' tar: '>=7.5.21 <8' qs: '>=6.16.0 <7' body-parser: '>=2.3.0 <3' - 'brace-expansion@>=3': '>=5.0.9 <6' + 'brace-expansion@>=3': '>=5.0.12 <6' # @vercel/sandbox pins zod exactly 3.24.4 (in Aikido's vulnerable <4.4.0 # range); forced major is accepted for this scanner-only workspace. zod: '>=4.4.0 <5' diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4d2d606..dfebc2e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,9 +10,9 @@ overrides: '@react-native-community/cli-server-api': '>=17.0.1' '@ungap/structured-clone': '>=1.3.1' '@xmldom/xmldom': '>=0.9.12' - brace-expansion@1: '>=1.1.18 <2' - brace-expansion@2: '>=2.1.4 <3' - brace-expansion@5: '>=5.0.9 <6' + brace-expansion@1: '>=1.1.21 <2' + brace-expansion@2: '>=2.1.7 <3' + brace-expansion@5: '>=5.0.12 <6' fast-xml-parser: '>=4.5.5' js-yaml@3: '>=3.15.2 <4' js-yaml@4: '>=4.3.2 <5' @@ -2370,14 +2370,14 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -7342,16 +7342,16 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -8802,15 +8802,15 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minipass@7.1.3: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8526196..1e6a996 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -40,9 +40,9 @@ overrides: '@react-native-community/cli-server-api': '>=17.0.1' '@ungap/structured-clone': '>=1.3.1' '@xmldom/xmldom': '>=0.9.12' - 'brace-expansion@1': '>=1.1.18 <2' - 'brace-expansion@2': '>=2.1.4 <3' - 'brace-expansion@5': '>=5.0.9 <6' + 'brace-expansion@1': '>=1.1.21 <2' + 'brace-expansion@2': '>=2.1.7 <3' + 'brace-expansion@5': '>=5.0.12 <6' 'fast-xml-parser': '>=4.5.5' # Cap at <4: uncapped this resolved to js-yaml 5.2.1, which is itself # vulnerable (GHSA-pm4m-ph32-ghv5, fixed in 5.2.2). 3.15.2 patches the 3.x