From c6fda054a72b7b65c667c85b9f894e99fca71cb6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 19:33:22 +0000 Subject: [PATCH] chore(deps): Bump adm-zip in /scripts/openai-like-server Bumps [adm-zip](https://github.com/cthackers/adm-zip) from 0.6.0 to 0.6.1. - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](https://github.com/cthackers/adm-zip/compare/v0.6.0...v0.6.1) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- scripts/openai-like-server/package-lock.json | 6 +++--- scripts/openai-like-server/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/openai-like-server/package-lock.json b/scripts/openai-like-server/package-lock.json index 4fe83515..215a986e 100644 --- a/scripts/openai-like-server/package-lock.json +++ b/scripts/openai-like-server/package-lock.json @@ -16,9 +16,9 @@ } }, "node_modules/adm-zip": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz", - "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==", + "version": "0.6.1", + "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.1.tgz", + "integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==", "license": "MIT", "engines": { "node": ">=14.0" diff --git a/scripts/openai-like-server/package.json b/scripts/openai-like-server/package.json index 5ce78d9e..2641bfc8 100644 --- a/scripts/openai-like-server/package.json +++ b/scripts/openai-like-server/package.json @@ -18,7 +18,7 @@ }, "//overrides": "adm-zip is a transitive dependency of onnxruntime-node's INSTALL script (it unzips the downloaded binaries) and is never executed here: we install with --ignore-scripts and the runtime only loads the native .node binding. Its <0.6.0 advisory (GHSA-xcpc-8h2w-3j85, a crafted ZIP allocating 4 GB) is therefore unreachable, but it is HIGH severity and would fail the Dockerfile's `npm audit --audit-level=high` gate. Forcing the patched 0.6.0 keeps that gate strict instead of turning it off.", "overrides": { - "adm-zip": "^0.6.0" + "adm-zip": "^0.6.1" }, "license": "AGPL-3.0" }