From 62f5a6c2f7adecf2438b4679e647c6e7eae102a7 Mon Sep 17 00:00:00 2001 From: Shashank Venkat Date: Tue, 4 Aug 2026 15:52:20 +0530 Subject: [PATCH] chore(deps): patch dependabot security alerts 305 and 306 Add pnpm overrides to fix 18 vulnerabilities in transitive dependencies: - undici: cross-user disclosure, CRLF injection, cookie injection - fast-uri: host confusion via backslash - ip-address: SSRF bypass via leading-zero octets and CIDR suffix - brace-expansion: DoS via unbounded intermediate arrays - hono: ReDoS in CORS middleware - file-type: ASF parser infinite loop, ZIP decompression bomb - diff: DoS in parsePatch/applyPatch related: #305, #306 Co-authored-by: Cursor --- .config/dictionary.txt | 2 + pnpm-lock.yaml | 118 ++++++++++++++++++----------------------- pnpm-workspace.yaml | 13 +++-- 3 files changed, 63 insertions(+), 70 deletions(-) diff --git a/.config/dictionary.txt b/.config/dictionary.txt index bb43c27e6..cd3f5810c 100644 --- a/.config/dictionary.txt +++ b/.config/dictionary.txt @@ -65,6 +65,7 @@ genai haaaad hbenl highlightjs +hono hostsvars inetpub issuetracker @@ -122,6 +123,7 @@ tomlsort towerhost tsdown typedarrays +undici unrs unstub uuidv diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7b6e9e2ae..a0aabce1b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,14 +11,17 @@ overrides: '@hono/node-server': '>=2.0.5 <3.0.0' '@xhmikosr/decompress@10': 10.2.1 body-parser: '>=2.3.0 <3.0.0' - brace-expansion@1: '>=5.0.8 <6.0.0' - brace-expansion@2: '>=2.1.2 <3.0.0' - brace-expansion@5: '>=5.0.8 <6.0.0' - fast-uri@3: '>=3.1.4 <4.0.0' + brace-expansion: '>=5.0.9' + diff@6: '>=8.0.3' + diff@7: '>=8.0.3' + fast-uri@3: '>=3.1.5 <4.0.0' fast-xml-parser: '>=5.10.1 <6.0.0' fastify: '>=5.8.3 <6.0.0' + file-type: '>=21.3.2' find-my-way: '>=9.7.0 <10.0.0' form-data@4: '>=4.0.6' + hono: '>=4.12.34' + ip-address: '>=10.3.1' js-yaml@5: '>=5.2.2' linkify-it: '>=5.0.2 <6.0.0' markdown-it: '>=14.2.0 <15.0.0' @@ -26,6 +29,8 @@ overrides: protobufjs@7: '>=7.6.5 <8.0.0' serialize-javascript: '>=7.0.5 <8.0.0' tar-fs@3: '>=3.1.2' + undici@6: '>=6.28.0' + undici@7: 7.29.0 ws@8: '>=8.17.1' packageExtensionsChecksum: sha256-l5iXATrO+IHdGlMiwq1daaoMDCcQ9gqreFXfc7KspzM= @@ -1163,7 +1168,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: ^4 + hono: '>=4.12.34' '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -2044,8 +2049,8 @@ packages: '@textlint/types@15.7.1': resolution: {integrity: sha512-Vye/GmFNBTgVzZFtIFJTmLB+s2A7oIADxNG6r9UhfPuY+Czv0z5G3xeyFZZudPlfxURsKUyPIU5XsjOFqVp33A==} - '@tokenizer/inflate@0.2.7': - resolution: {integrity: sha512-MADQgmZT1eKjp06jpI2yozxaU9uVs4GzzgSL+uEq7bVcJ9V1ZXQkeGNql1fsSI0gMy1vhvNTNbUqrx+pZfJVmg==} + '@tokenizer/inflate@0.4.1': + resolution: {integrity: sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA==} engines: {node: '>=18'} '@tokenizer/token@0.3.0': @@ -2867,9 +2872,6 @@ packages: react-native-b4a: optional: true - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -2952,9 +2954,6 @@ packages: boundary@2.0.0: resolution: {integrity: sha512-rJKn5ooC9u8q13IMCrW0RSp31pxBCHE3y9V/tp3TdWSLf8Em3p6Di4NBpfzbJge9YjjFEsD0RtFEjtvHL5VyEA==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.9: resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} engines: {node: 20 || >=22} @@ -3470,10 +3469,6 @@ packages: resolution: {integrity: sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==} engines: {node: '>=0.3.1'} - diff@7.0.0: - resolution: {integrity: sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==} - engines: {node: '>=0.3.1'} - diff@8.0.4: resolution: {integrity: sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==} engines: {node: '>=0.3.1'} @@ -4001,9 +3996,9 @@ packages: resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==} engines: {node: '>=16.0.0'} - file-type@20.5.0: - resolution: {integrity: sha512-BfHZtG/l9iMm4Ecianu7P8HRD2tBHLtjXinm4X62XBOYzi7CYA7jyqfJzOvXHqzVrVPYqBo2/GvbARMaaJkKVg==} - engines: {node: '>=18'} + file-type@22.0.1: + resolution: {integrity: sha512-ww5Mhre0EE+jmBvOXTmXAbEMuZE7uX4a3+oRCQFNj8w++g3ev913N6tXQz0XTXbueQ5TWQfm6BdaViEHHn8bhA==} + engines: {node: '>=22'} filelist@1.0.6: resolution: {integrity: sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==} @@ -4310,8 +4305,8 @@ packages: resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==} engines: {node: '>=12.0.0'} - hono@4.12.27: - resolution: {integrity: sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==} + hono@4.12.34: + resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} engines: {node: '>=16.9.0'} hookable@6.1.1: @@ -4452,8 +4447,8 @@ packages: resolution: {integrity: sha512-CYdFeFexxhv/Bcny+Q0BfOV+ltRlJcd4BBZBYFX/O0u4npJrgZtIcjokegtiSMAvlMTJ+Koq0GBCc//3bueQxw==} engines: {node: '>=8'} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.4.0: + resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -6679,14 +6674,14 @@ packages: undici-types@7.28.0: resolution: {integrity: sha512-LJAfY+2w6HGeT8d8J1wNQsUGUEGio6NWWpwdwurQe4f6oojzCFuGLizl1KSve4irsTxyLly1QhEeE6iapdaIvQ==} - undici@6.27.0: - resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==} - engines: {node: '>=18.17'} - - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} + engines: {node: '>=22.19.0'} + unicorn-magic@0.1.0: resolution: {integrity: sha512-lRfVq8fE8gz6QMBuDM6a+LO3IAzTi05H6gCVaUpir2E1Rwpo4ZUog45KpNXKC/Mn3Yb9UDuHumeFTo9iV/D9FQ==} engines: {node: '>=18'} @@ -7615,7 +7610,7 @@ snapshots: semver: 7.8.5 sumchecker: 3.0.1(supports-color@8.1.1) optionalDependencies: - undici: 7.28.0 + undici: 7.29.0 transitivePeerDependencies: - supports-color @@ -7846,9 +7841,9 @@ snapshots: highlight.js: 11.11.1 vue: 3.5.39(typescript@6.0.3) - '@hono/node-server@2.0.12(hono@4.12.27)': + '@hono/node-server@2.0.12(hono@4.12.34)': dependencies: - hono: 4.12.27 + hono: 4.12.34 '@humanfs/core@0.19.2': dependencies: @@ -8068,7 +8063,7 @@ snapshots: '@modelcontextprotocol/sdk@1.30.0(supports-color@8.1.1)(zod@4.4.3)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.27) + '@hono/node-server': 2.0.12(hono@4.12.34) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -8078,7 +8073,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1(supports-color@8.1.1) express-rate-limit: 8.5.2(express@5.2.1(supports-color@8.1.1)) - hono: 4.12.27 + hono: 4.12.34 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -8629,10 +8624,9 @@ snapshots: dependencies: '@textlint/ast-node-types': 15.7.1 - '@tokenizer/inflate@0.2.7(supports-color@8.1.1)': + '@tokenizer/inflate@0.4.1(supports-color@8.1.1)': dependencies: debug: 4.4.3(supports-color@8.1.1) - fflate: 0.8.3 token-types: 6.1.2 transitivePeerDependencies: - supports-color @@ -9419,13 +9413,13 @@ snapshots: '@xhmikosr/archive-type@7.1.0(supports-color@8.1.1)': dependencies: - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) transitivePeerDependencies: - supports-color '@xhmikosr/decompress-tar@8.1.0(supports-color@8.1.1)': dependencies: - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) is-stream: 2.0.1 tar-stream: 3.2.0 transitivePeerDependencies: @@ -9437,7 +9431,7 @@ snapshots: '@xhmikosr/decompress-tarbz2@8.1.0(supports-color@8.1.1)': dependencies: '@xhmikosr/decompress-tar': 8.1.0(supports-color@8.1.1) - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) is-stream: 2.0.1 seek-bzip: 2.0.0 unbzip2-stream: 1.4.3 @@ -9450,7 +9444,7 @@ snapshots: '@xhmikosr/decompress-targz@8.1.0(supports-color@8.1.1)': dependencies: '@xhmikosr/decompress-tar': 8.1.0(supports-color@8.1.1) - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) is-stream: 2.0.1 transitivePeerDependencies: - bare-abort-controller @@ -9460,7 +9454,7 @@ snapshots: '@xhmikosr/decompress-unzip@7.1.0(supports-color@8.1.1)': dependencies: - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) get-stream: 6.0.1 yauzl: 3.4.0 transitivePeerDependencies: @@ -9487,7 +9481,7 @@ snapshots: content-disposition: 0.5.4 defaults: 2.0.2 ext-name: 5.0.0 - file-type: 20.5.0(supports-color@8.1.1) + file-type: 22.0.1(supports-color@8.1.1) filenamify: 6.0.0 get-stream: 6.0.1 got: 13.0.0 @@ -9701,8 +9695,6 @@ snapshots: b4a@1.8.1: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} bare-events@2.9.1: {} @@ -9781,10 +9773,6 @@ snapshots: boundary@2.0.0: {} - brace-expansion@2.1.4: - dependencies: - balanced-match: 1.0.2 - brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -9909,7 +9897,7 @@ snapshots: parse5: 7.3.0 parse5-htmlparser2-tree-adapter: 7.1.0 parse5-parser-stream: 7.1.2 - undici: 7.28.0 + undici: 7.29.0 whatwg-mimetype: 4.0.0 chokidar@3.6.0: @@ -10333,8 +10321,6 @@ snapshots: diff@5.2.2: {} - diff@7.0.0: {} - diff@8.0.4: {} diff@9.0.0: {} @@ -10878,7 +10864,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1(supports-color@8.1.1)): dependencies: express: 5.2.1(supports-color@8.1.1) - ip-address: 10.2.0 + ip-address: 10.4.0 express@5.2.1(supports-color@8.1.1): dependencies: @@ -11042,9 +11028,9 @@ snapshots: dependencies: flat-cache: 4.0.1 - file-type@20.5.0(supports-color@8.1.1): + file-type@22.0.1(supports-color@8.1.1): dependencies: - '@tokenizer/inflate': 0.2.7(supports-color@8.1.1) + '@tokenizer/inflate': 0.4.1(supports-color@8.1.1) strtok3: 10.3.5 token-types: 6.1.2 uint8array-extras: 1.5.0 @@ -11403,7 +11389,7 @@ snapshots: highlight.js@11.11.1: {} - hono@4.12.27: {} + hono@4.12.34: {} hookable@6.1.1: {} @@ -11534,7 +11520,7 @@ snapshots: invert-kv@3.0.1: {} - ip-address@10.2.0: {} + ip-address@10.4.0: {} ipaddr.js@1.9.1: {} @@ -11853,7 +11839,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -12444,11 +12430,11 @@ snapshots: minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 5.0.9 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 5.0.9 minimist@1.2.8: {} @@ -12512,7 +12498,7 @@ snapshots: browser-stdout: 1.3.1 chokidar: 4.0.3 debug: 4.4.3(supports-color@8.1.1) - diff: 7.0.0 + diff: 9.0.0 escape-string-regexp: 4.0.0 find-up: 5.0.0 glob: 10.5.0 @@ -13541,7 +13527,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.2.0 + ip-address: 10.4.0 smart-buffer: 4.2.0 sonic-boom@4.2.1: @@ -14055,9 +14041,9 @@ snapshots: undici-types@7.28.0: {} - undici@6.27.0: {} + undici@7.29.0: {} - undici@7.28.0: {} + undici@8.10.0: {} unicorn-magic@0.1.0: {} @@ -14253,7 +14239,7 @@ snapshots: slash: 5.1.0 tinyclip: 0.1.15 tmp-promise: 3.0.3 - undici: 6.27.0 + undici: 8.10.0 vscode-uri: 3.1.0 ws: 8.21.0 yargs-parser: 21.1.1 @@ -14280,7 +14266,7 @@ snapshots: '@wdio/utils': 9.29.1(supports-color@8.1.1) deepmerge-ts: 7.1.5 https-proxy-agent: 7.0.6(supports-color@8.1.1) - undici: 6.27.0 + undici: 8.10.0 ws: 8.21.0 transitivePeerDependencies: - bare-abort-controller diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a519d27a4..221e3e071 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -24,14 +24,17 @@ overrides: "@hono/node-server": ">=2.0.5 <3.0.0" "@xhmikosr/decompress@10": "10.2.1" "body-parser": ">=2.3.0 <3.0.0" - "brace-expansion@1": ">=5.0.8 <6.0.0" - "brace-expansion@2": ">=2.1.2 <3.0.0" - "brace-expansion@5": ">=5.0.8 <6.0.0" - "fast-uri@3": ">=3.1.4 <4.0.0" + "brace-expansion": ">=5.0.9" + "diff@6": ">=8.0.3" + "diff@7": ">=8.0.3" + "fast-uri@3": ">=3.1.5 <4.0.0" "fast-xml-parser": ">=5.10.1 <6.0.0" "fastify": ">=5.8.3 <6.0.0" + "file-type": ">=21.3.2" "find-my-way": ">=9.7.0 <10.0.0" "form-data@4": ">=4.0.6" + "hono": ">=4.12.34" + "ip-address": ">=10.3.1" "js-yaml@5": ">=5.2.2" "linkify-it": ">=5.0.2 <6.0.0" "markdown-it": ">=14.2.0 <15.0.0" @@ -39,6 +42,8 @@ overrides: "protobufjs@7": ">=7.6.5 <8.0.0" "serialize-javascript": ">=7.0.5 <8.0.0" "tar-fs@3": ">=3.1.2" + "undici@6": ">=6.28.0" + "undici@7": "7.29.0" "ws@8": ">=8.17.1" patchedDependencies: