Skip to content

[Snyk] Security upgrade node-gyp from 11.2.0 to 12.0.0 #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnnyhuy merged 3 commits into from
Aug 18, 2026
Merged

[Snyk] Security upgrade node-gyp from 11.2.0 to 12.0.0 #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4938599
fix: packages/backend/package.json to reduce vulnerabilities
snyk-bot Feb 8, 2026
edea954
Merge remote-tracking branch 'origin/main' into snyk-fix-746e2164c95f…
johnnyhuy Aug 18, 2026
bd8ed9a
chore: refresh yarn.lock after merging main
johnnyhuy Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"app": "link:../app",
"better-sqlite3": "^12.0.0",
"dockerode": "^4.0.5",
"node-gyp": "^11.2.0",
"node-gyp": "^12.0.0",

Copilot AI Feb 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description indicates the yarn.lock update failed and must be updated manually. Upgrading a dependency without updating the lockfile may leave vulnerable transitive versions in place (or make installs non-reproducible) and can prevent the vulnerability fix from actually applying. Regenerate and commit the updated yarn.lock (and, if using Yarn zero-installs, the .yarn/cache/ artifacts) so CI and consumers reliably get the patched dependency graph.

Suggested change
"node-gyp": "^12.0.0",
"node-gyp": "^11.0.0",

Copilot uses AI. Check for mistakes.
"pg": "^8.11.3",
"winston": "^3.2.1"
},
Expand Down
207 changes: 47 additions & 160 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9111,19 +9111,6 @@ __metadata:
languageName: node
linkType: hard

"@npmcli/agent@npm:^3.0.0":
version: 3.0.0
resolution: "@npmcli/agent@npm:3.0.0"
dependencies:
agent-base: "npm:^7.1.0"
http-proxy-agent: "npm:^7.0.0"
https-proxy-agent: "npm:^7.0.1"
lru-cache: "npm:^10.0.1"
socks-proxy-agent: "npm:^8.0.3"
checksum: 10c0/efe37b982f30740ee77696a80c196912c274ecd2cb243bc6ae7053a50c733ce0f6c09fda085145f33ecf453be19654acca74b69e81eaad4c90f00ccffe2f9271
languageName: node
linkType: hard

"@npmcli/fs@npm:^2.1.0":
version: 2.1.2
resolution: "@npmcli/fs@npm:2.1.2"
Expand All @@ -9143,15 +9130,6 @@ __metadata:
languageName: node
linkType: hard

"@npmcli/fs@npm:^4.0.0":
version: 4.0.0
resolution: "@npmcli/fs@npm:4.0.0"
dependencies:
semver: "npm:^7.3.5"
checksum: 10c0/c90935d5ce670c87b6b14fab04a965a3b8137e585f8b2a6257263bd7f97756dd736cb165bb470e5156a9e718ecd99413dccc54b1138c1a46d6ec7cf325982fe5
languageName: node
linkType: hard

"@npmcli/git@npm:^4.0.0":
version: 4.1.0
resolution: "@npmcli/git@npm:4.1.0"
Expand Down Expand Up @@ -15022,10 +15000,10 @@ __metadata:
languageName: node
linkType: hard

"abbrev@npm:^3.0.0":
version: 3.0.1
resolution: "abbrev@npm:3.0.1"
checksum: 10c0/21ba8f574ea57a3106d6d35623f2c4a9111d9ee3e9a5be47baed46ec2457d2eac46e07a5c4a60186f88cb98abbe3e24f2d4cca70bc2b12f1692523e2209a9ccf
"abbrev@npm:^4.0.0":
version: 4.0.0
resolution: "abbrev@npm:4.0.0"
checksum: 10c0/b4cc16935235e80702fc90192e349e32f8ef0ed151ef506aa78c81a7c455ec18375c4125414b99f84b2e055199d66383e787675f0bcd87da7a4dbd59f9eac1d5
languageName: node
linkType: hard

Expand Down Expand Up @@ -16241,7 +16219,7 @@ __metadata:
dockerode: "npm:^4.0.5"
jose: "npm:^5.6.3"
msw: "npm:^2.3.4"
node-gyp: "npm:^11.2.0"
node-gyp: "npm:^12.0.0"
pg: "npm:^8.11.3"
supertest: "npm:^7.0.0"
winston: "npm:^3.2.1"
Expand Down Expand Up @@ -17020,26 +16998,6 @@ __metadata:
languageName: node
linkType: hard

"cacache@npm:^19.0.1":
version: 19.0.1
resolution: "cacache@npm:19.0.1"
dependencies:
"@npmcli/fs": "npm:^4.0.0"
fs-minipass: "npm:^3.0.0"
glob: "npm:^10.2.2"
lru-cache: "npm:^10.0.1"
minipass: "npm:^7.0.3"
minipass-collect: "npm:^2.0.1"
minipass-flush: "npm:^1.0.5"
minipass-pipeline: "npm:^1.2.4"
p-map: "npm:^7.0.2"
ssri: "npm:^12.0.0"
tar: "npm:^7.4.3"
unique-filename: "npm:^4.0.0"
checksum: 10c0/01f2134e1bd7d3ab68be851df96c8d63b492b1853b67f2eecb2c37bb682d37cb70bb858a16f2f0554d3c0071be6dfe21456a1ff6fa4b7eed996570d6a25ffe9c
languageName: node
linkType: hard

"cacheable-lookup@npm:^6.0.0":
version: 6.1.0
resolution: "cacheable-lookup@npm:6.1.0"
Expand Down Expand Up @@ -24825,6 +24783,13 @@ __metadata:
languageName: node
linkType: hard

"isexe@npm:^4.0.0":
version: 4.0.0
resolution: "isexe@npm:4.0.0"
checksum: 10c0/5884815115bceac452877659a9c7726382531592f43dc29e5d48b7c4100661aed54018cb90bd36cb2eaeba521092570769167acbb95c18d39afdccbcca06c5ce
languageName: node
linkType: hard

"isobject@npm:^3.0.1":
version: 3.0.1
resolution: "isobject@npm:3.0.1"
Expand Down Expand Up @@ -27047,25 +27012,6 @@ __metadata:
languageName: node
linkType: hard

"make-fetch-happen@npm:^14.0.3":
version: 14.0.3
resolution: "make-fetch-happen@npm:14.0.3"
dependencies:
"@npmcli/agent": "npm:^3.0.0"
cacache: "npm:^19.0.1"
http-cache-semantics: "npm:^4.1.1"
minipass: "npm:^7.0.2"
minipass-fetch: "npm:^4.0.0"
minipass-flush: "npm:^1.0.5"
minipass-pipeline: "npm:^1.2.4"
negotiator: "npm:^1.0.0"
proc-log: "npm:^5.0.0"
promise-retry: "npm:^2.0.1"
ssri: "npm:^12.0.0"
checksum: 10c0/c40efb5e5296e7feb8e37155bde8eb70bc57d731b1f7d90e35a092fde403d7697c56fb49334d92d330d6f1ca29a98142036d6480a12681133a0a1453164cb2f0
languageName: node
linkType: hard

"makeerror@npm:1.0.12":
version: 1.0.12
resolution: "makeerror@npm:1.0.12"
Expand Down Expand Up @@ -28106,21 +28052,6 @@ __metadata:
languageName: node
linkType: hard

"minipass-fetch@npm:^4.0.0":
version: 4.0.1
resolution: "minipass-fetch@npm:4.0.1"
dependencies:
encoding: "npm:^0.1.13"
minipass: "npm:^7.0.3"
minipass-sized: "npm:^1.0.3"
minizlib: "npm:^3.0.1"
dependenciesMeta:
encoding:
optional: true
checksum: 10c0/a3147b2efe8e078c9bf9d024a0059339c5a09c5b1dded6900a219c218cc8b1b78510b62dae556b507304af226b18c3f1aeb1d48660283602d5b6586c399eed5c
languageName: node
linkType: hard

"minipass-flush@npm:^1.0.5":
version: 1.0.5
resolution: "minipass-flush@npm:1.0.5"
Expand Down Expand Up @@ -28205,15 +28136,6 @@ __metadata:
languageName: node
linkType: hard

"minizlib@npm:^3.0.1":
version: 3.0.2
resolution: "minizlib@npm:3.0.2"
dependencies:
minipass: "npm:^7.1.2"
checksum: 10c0/9f3bd35e41d40d02469cb30470c55ccc21cae0db40e08d1d0b1dff01cc8cc89a6f78e9c5d2b7c844e485ec0a8abc2238111213fdc5b2038e6d1012eacf316f78
languageName: node
linkType: hard

"minizlib@npm:^3.1.0":
version: 3.1.0
resolution: "minizlib@npm:3.1.0"
Expand Down Expand Up @@ -28634,13 +28556,6 @@ __metadata:
languageName: node
linkType: hard

"negotiator@npm:^1.0.0":
version: 1.0.0
resolution: "negotiator@npm:1.0.0"
checksum: 10c0/4c559dd52669ea48e1914f9d634227c561221dd54734070791f999c52ed0ff36e437b2e07d5c1f6e32909fc625fe46491c16e4a8f0572567d4dd15c3a4fda04b
languageName: node
linkType: hard

"neo-async@npm:^2.6.2":
version: 2.6.2
resolution: "neo-async@npm:2.6.2"
Expand Down Expand Up @@ -28827,23 +28742,23 @@ __metadata:
languageName: node
linkType: hard

"node-gyp@npm:^11.2.0":
version: 11.2.0
resolution: "node-gyp@npm:11.2.0"
"node-gyp@npm:^12.0.0":
version: 12.4.0
resolution: "node-gyp@npm:12.4.0"
dependencies:
env-paths: "npm:^2.2.0"
exponential-backoff: "npm:^3.1.1"
graceful-fs: "npm:^4.2.6"
make-fetch-happen: "npm:^14.0.3"
nopt: "npm:^8.0.0"
proc-log: "npm:^5.0.0"
nopt: "npm:^9.0.0"
proc-log: "npm:^6.0.0"
semver: "npm:^7.3.5"
tar: "npm:^7.4.3"
tar: "npm:^7.5.4"
tinyglobby: "npm:^0.2.12"
which: "npm:^5.0.0"
undici: "npm:^6.25.0"
which: "npm:^6.0.0"
bin:
node-gyp: bin/node-gyp.js
checksum: 10c0/bd8d8c76b06be761239b0c8680f655f6a6e90b48e44d43415b11c16f7e8c15be346fba0cbf71588c7cdfb52c419d928a7d3db353afc1d952d19756237d8f10b9
checksum: 10c0/9acb7c798e124275a6f9c1f7eb64b5abd6196bb885a3945fb44ee0dccf435514e88cdfb0f228ee7ff76ef25107c1f39ff37a067bf92fd00b9aff9234db29ff9e
languageName: node
linkType: hard

Expand Down Expand Up @@ -28991,14 +28906,14 @@ __metadata:
languageName: node
linkType: hard

"nopt@npm:^8.0.0":
version: 8.1.0
resolution: "nopt@npm:8.1.0"
"nopt@npm:^9.0.0":
version: 9.0.0
resolution: "nopt@npm:9.0.0"
dependencies:
abbrev: "npm:^3.0.0"
abbrev: "npm:^4.0.0"
bin:
nopt: bin/nopt.js
checksum: 10c0/62e9ea70c7a3eb91d162d2c706b6606c041e4e7b547cbbb48f8b3695af457dd6479904d7ace600856bf923dd8d1ed0696f06195c8c20f02ac87c1da0e1d315ef
checksum: 10c0/1822eb6f9b020ef6f7a7516d7b64a8036e09666ea55ac40416c36e4b2b343122c3cff0e2f085675f53de1d2db99a2a89a60ccea1d120bcd6a5347bf6ceb4a7fd
languageName: node
linkType: hard

Expand Down Expand Up @@ -29870,13 +29785,6 @@ __metadata:
languageName: node
linkType: hard

"p-map@npm:^7.0.2":
version: 7.0.3
resolution: "p-map@npm:7.0.3"
checksum: 10c0/46091610da2b38ce47bcd1d8b4835a6fa4e832848a6682cf1652bc93915770f4617afc844c10a77d1b3e56d2472bb2d5622353fa3ead01a7f42b04fc8e744a5c
languageName: node
linkType: hard

"p-pipe@npm:3.1.0":
version: 3.1.0
resolution: "p-pipe@npm:3.1.0"
Expand Down Expand Up @@ -31330,10 +31238,10 @@ __metadata:
languageName: node
linkType: hard

"proc-log@npm:^5.0.0":
version: 5.0.0
resolution: "proc-log@npm:5.0.0"
checksum: 10c0/bbe5edb944b0ad63387a1d5b1911ae93e05ce8d0f60de1035b218cdcceedfe39dbd2c697853355b70f1a090f8f58fe90da487c85216bf9671f9499d1a897e9e3
"proc-log@npm:^6.0.0":
version: 6.1.0
resolution: "proc-log@npm:6.1.0"
checksum: 10c0/4f178d4062733ead9d71a9b1ab24ebcecdfe2250916a5b1555f04fe2eda972a0ec76fbaa8df1ad9c02707add6749219d118a4fc46dc56bdfe4dde4b47d80bb82
languageName: node
linkType: hard

Expand Down Expand Up @@ -34675,15 +34583,6 @@ __metadata:
languageName: node
linkType: hard

"ssri@npm:^12.0.0":
version: 12.0.0
resolution: "ssri@npm:12.0.0"
dependencies:
minipass: "npm:^7.0.3"
checksum: 10c0/caddd5f544b2006e88fa6b0124d8d7b28208b83c72d7672d5ade44d794525d23b540f3396108c4eb9280dcb7c01f0bef50682f5b4b2c34291f7c5e211fd1417d
languageName: node
linkType: hard

"ssri@npm:^9.0.0, ssri@npm:^9.0.1":
version: 9.0.1
resolution: "ssri@npm:9.0.1"
Expand Down Expand Up @@ -35622,17 +35521,16 @@ __metadata:
languageName: node
linkType: hard

"tar@npm:^7.4.3":
version: 7.4.3
resolution: "tar@npm:7.4.3"
"tar@npm:^7.5.4":
version: 7.5.22
resolution: "tar@npm:7.5.22"
dependencies:
"@isaacs/fs-minipass": "npm:^4.0.0"
chownr: "npm:^3.0.0"
minipass: "npm:^7.1.2"
minizlib: "npm:^3.0.1"
mkdirp: "npm:^3.0.1"
minizlib: "npm:^3.1.0"
yallist: "npm:^5.0.0"
checksum: 10c0/d4679609bb2a9b48eeaf84632b6d844128d2412b95b6de07d53d8ee8baf4ca0857c9331dfa510390a0727b550fd543d4d1a10995ad86cdf078423fbb8d99831d
checksum: 10c0/1311f6be85a8157ac4c9147bae43e13923d2a1aae15e4aa1bd5239e4e03d2cf53cfe103dde7f35832fbb4c938b042856bc8e9a0afd29abd05e2d1608788c4fea
languageName: node
linkType: hard

Expand Down Expand Up @@ -36893,6 +36791,13 @@ __metadata:
languageName: node
linkType: hard

"undici@npm:^6.25.0":
version: 6.28.0
resolution: "undici@npm:6.28.0"
checksum: 10c0/3029a70df06b38b5b2f30732932a1e92544c753cd82c8abdf0d35afad48e0ba91612e79fe3a442dbbb9434d6a9eba2b714d5ea28984c903dda2b5d5444f38354
languageName: node
linkType: hard

"undici@npm:^7.24.5":
version: 7.26.0
resolution: "undici@npm:7.26.0"
Expand Down Expand Up @@ -36940,15 +36845,6 @@ __metadata:
languageName: node
linkType: hard

"unique-filename@npm:^4.0.0":
version: 4.0.0
resolution: "unique-filename@npm:4.0.0"
dependencies:
unique-slug: "npm:^5.0.0"
checksum: 10c0/38ae681cceb1408ea0587b6b01e29b00eee3c84baee1e41fd5c16b9ed443b80fba90c40e0ba69627e30855570a34ba8b06702d4a35035d4b5e198bf5a64c9ddc
languageName: node
linkType: hard

"unique-slug@npm:^3.0.0":
version: 3.0.0
resolution: "unique-slug@npm:3.0.0"
Expand All @@ -36967,15 +36863,6 @@ __metadata:
languageName: node
linkType: hard

"unique-slug@npm:^5.0.0":
version: 5.0.0
resolution: "unique-slug@npm:5.0.0"
dependencies:
imurmurhash: "npm:^0.1.4"
checksum: 10c0/d324c5a44887bd7e105ce800fcf7533d43f29c48757ac410afd42975de82cc38ea2035c0483f4de82d186691bf3208ef35c644f73aa2b1b20b8e651be5afd293
languageName: node
linkType: hard

"unist-util-generated@npm:^2.0.0":
version: 2.0.1
resolution: "unist-util-generated@npm:2.0.1"
Expand Down Expand Up @@ -38015,14 +37902,14 @@ __metadata:
languageName: node
linkType: hard

"which@npm:^5.0.0":
version: 5.0.0
resolution: "which@npm:5.0.0"
"which@npm:^6.0.0":
version: 6.0.1
resolution: "which@npm:6.0.1"
dependencies:
isexe: "npm:^3.1.1"
isexe: "npm:^4.0.0"
bin:
node-which: bin/which.js
checksum: 10c0/e556e4cd8b7dbf5df52408c9a9dd5ac6518c8c5267c8953f5b0564073c66ed5bf9503b14d876d0e9c7844d4db9725fb0dcf45d6e911e17e26ab363dc3965ae7b
checksum: 10c0/7e710e54ea36d2d6183bee2f9caa27a3b47b9baf8dee55a199b736fcf85eab3b9df7556fca3d02b50af7f3dfba5ea3a45644189836df06267df457e354da66d5
languageName: node
linkType: hard

Expand Down
Loading