From 8e5abc24a730ad6b85649dc605d29da2822d6bee Mon Sep 17 00:00:00 2001 From: RubenGlez Date: Fri, 14 Aug 2026 09:19:33 +0200 Subject: [PATCH] fix: address high CVEs in js-yaml and nanoid - js-yaml >=4.0.0 <4.3.1 (GHSA-5p4m-2wfm-xmqj, high): quadratic CPU consumption resolving !!omap. Reached from both apps/dashboard and packages/cli. Bumped the declared dependency in each, not just the override, because overrides don't apply to consumers of the published @easydocs/cli and @easydocs/dashboard. - nanoid <3.3.18 (GHSA-2v37-7h3g-55p8, high): custom generators loop indefinitely when size is zero. Only reached via next > postcss, which pins ^3.3.x, so the override stays on the 3.x line. `pnpm audit --audit-level=high --prod` now exits 0, unblocking `pnpm release`. Two low-severity advisories remain (@babel/core, body-parser), both below the release gate's threshold. Claude-Session: https://claude.ai/code/session_01GrfumUQ4vFUAgsFYwzDyK8 --- apps/dashboard/package.json | 4 ++-- packages/cli/package.json | 4 ++-- pnpm-lock.yaml | 32 +++++++++++++++++--------------- pnpm-workspace.yaml | 4 +++- 4 files changed, 24 insertions(+), 20 deletions(-) diff --git a/apps/dashboard/package.json b/apps/dashboard/package.json index 8a957a4..4156fdf 100644 --- a/apps/dashboard/package.json +++ b/apps/dashboard/package.json @@ -4,7 +4,7 @@ "engines": { "node": ">=24" }, - "description": "EasyDocs dashboard — browse and export OpenAPI specs generated from your API's real traffic.", + "description": "EasyDocs dashboard \u2014 browse and export OpenAPI specs generated from your API's real traffic.", "files": [ "src", "public", @@ -25,7 +25,7 @@ "@codemirror/theme-one-dark": "^6.1.3", "@easydocs/core": "workspace:*", "@uiw/react-codemirror": "^4.25.9", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "next": "16.2.11", "react": "^19.0.0", "react-dom": "^19.2.6", diff --git a/packages/cli/package.json b/packages/cli/package.json index c472f49..1557dd3 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -8,7 +8,7 @@ "dist", "README.md" ], - "description": "EasyDocs CLI — capture via proxy, export OpenAPI specs, and diff specs in CI. Runs locally.", + "description": "EasyDocs CLI \u2014 capture via proxy, export OpenAPI specs, and diff specs in CI. Runs locally.", "type": "module", "bin": { "easydocs": "./dist/index.js" @@ -22,7 +22,7 @@ }, "dependencies": { "@easydocs/core": "workspace:*", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "devDependencies": { "@types/js-yaml": "^4.0.9", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6231e91..8235c21 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,9 +9,10 @@ overrides: glob: ^10.5.0 minimatch: 10.2.6 flatted: ^3.4.2 - js-yaml: ^4.1.1 + js-yaml: ^4.3.1 picomatch: ^2.3.2 postcss: ^8.5.18 + nanoid: ^3.3.18 brace-expansion: 5.0.8 sharp: 0.35.3 vite: ^8.0.16 @@ -60,8 +61,8 @@ importers: specifier: ^4.25.9 version: 4.25.9(@babel/runtime@7.29.7)(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.7.1)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.0)(codemirror@6.0.2)(react-dom@19.2.6(react@19.0.0))(react@19.0.0) js-yaml: - specifier: ^4.1.1 - version: 4.3.0 + specifier: ^4.3.1 + version: 4.3.1 next: specifier: 16.2.11 version: 16.2.11(@babel/core@7.29.0(supports-color@7.2.0))(@opentelemetry/api@1.9.1)(@types/node@20.17.16)(react-dom@19.2.6(react@19.0.0))(react@19.0.0) @@ -153,8 +154,8 @@ importers: specifier: workspace:* version: link:../core js-yaml: - specifier: ^4.1.1 - version: 4.3.0 + specifier: ^4.3.1 + version: 4.3.1 devDependencies: '@types/js-yaml': specifier: ^4.0.9 @@ -2786,6 +2787,7 @@ packages: '@xmldom/xmldom@0.9.10': resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} engines: {node: '>=14.6'} + deprecated: this version has critical issues, please update to the latest version a-sync-waterfall@1.0.1: resolution: {integrity: sha512-RYTOHHdWipFUliRFMCS4X2Yn2X8M87V/OpSqWzKKOGhzqyUxzyVmhHDH9sAvG+ZuQf/TAOFsLCpMw09I1ufUnA==} @@ -4566,8 +4568,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsesc@3.1.0: @@ -4972,8 +4974,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -6614,7 +6616,7 @@ snapshots: '@apidevtools/json-schema-ref-parser@15.3.5(@types/json-schema@7.0.15)': dependencies: '@types/json-schema': 7.0.15 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@aws-crypto/crc32@5.2.0': dependencies: @@ -7590,7 +7592,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 minimatch: 10.2.6 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -11266,7 +11268,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -11662,7 +11664,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.16: {} + nanoid@3.3.18: {} natural-compare@1.4.0: {} @@ -12180,7 +12182,7 @@ snapshots: postcss@8.5.23: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -12270,7 +12272,7 @@ snapshots: http-z: 8.1.1 istextorbinary: 9.5.0 js-rouge: 3.2.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 json5: 2.2.3 keyv: 5.6.0 keyv-file: 5.3.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 523af2a..36979e3 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,9 +9,11 @@ overrides: glob: ^10.5.0 minimatch: 10.2.6 flatted: ^3.4.2 - js-yaml: ^4.1.1 + js-yaml: ^4.3.1 picomatch: ^2.3.2 postcss: ^8.5.18 + # Reached via next > postcss, which pins ^3.3.x — stay on the 3.x line. + nanoid: ^3.3.18 brace-expansion: 5.0.8 sharp: 0.35.3 vite: ^8.0.16