diff --git a/.changes/deps-transitive-cve-overrides.md b/.changes/deps-transitive-cve-overrides.md new file mode 100644 index 000000000..4a1234242 --- /dev/null +++ b/.changes/deps-transitive-cve-overrides.md @@ -0,0 +1,10 @@ +--- +type: internal +area: deps +--- + +Closes the four open Dependabot alerts on transitive npm dependencies via +pinned pnpm overrides: browserslist (crash on untrusted stats), @xmldom/xmldom +(XML fragment injection — its existing override target had itself fallen into +the advisory range), @humanfs/node (recursive copy follows symlinks out of the +tree) and postcss-selector-parser (AST recursion DoS). diff --git a/package.json b/package.json index 85a5e68ad..d1ada528a 100644 --- a/package.json +++ b/package.json @@ -241,10 +241,12 @@ "overrides": { "@esbuild-kit/core-utils>esbuild": "0.25.12", "@hono/node-server@1.19.9": "1.19.17", - "@xmldom/xmldom@0.8.11": "0.8.13", + "@humanfs/node@0.16.7": "0.16.8", + "@xmldom/xmldom@0.8.11": "0.8.15", "ajv@6.12.6": "6.14.0", "ajv@8.17.1": "8.18.0", "brace-expansion@1.1.12": "1.1.18", + "browserslist@4.28.1": "4.28.8", "defu@6.1.4": "6.1.6", "devalue@5.6.2": "5.6.4", "express-rate-limit@8.2.1": "8.3.0", @@ -265,6 +267,7 @@ "path-to-regexp@0.1.12": "0.1.13", "picomatch@2.3.1": "2.3.2", "picomatch@4.0.3": "4.0.5", + "postcss-selector-parser@6.1.2": "6.1.4", "postcss@8.5.6": "8.5.26", "qs@6.14.1": "6.15.3", "rollup@4.52.3": "4.59.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 661170a4a..a4522499d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,10 +7,12 @@ settings: overrides: '@esbuild-kit/core-utils>esbuild': 0.25.12 '@hono/node-server@1.19.9': 1.19.17 - '@xmldom/xmldom@0.8.11': 0.8.13 + '@humanfs/node@0.16.7': 0.16.8 + '@xmldom/xmldom@0.8.11': 0.8.15 ajv@6.12.6: 6.14.0 ajv@8.17.1: 8.18.0 brace-expansion@1.1.12: 1.1.18 + browserslist@4.28.1: 4.28.8 defu@6.1.4: 6.1.6 devalue@5.6.2: 5.6.4 express-rate-limit@8.2.1: 8.3.0 @@ -31,6 +33,7 @@ overrides: path-to-regexp@0.1.12: 0.1.13 picomatch@2.3.1: 2.3.2 picomatch@4.0.3: 4.0.5 + postcss-selector-parser@6.1.2: 6.1.4 postcss@8.5.6: 8.5.26 qs@6.14.1: 6.15.3 rollup@4.52.3: 4.59.0 @@ -2294,12 +2297,16 @@ packages: peerDependencies: hono: 4.12.34 - '@humanfs/core@0.19.1': - resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} + '@humanfs/core@0.19.2': + resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} engines: {node: '>=18.18.0'} - '@humanfs/node@0.16.7': - resolution: {integrity: sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==} + '@humanfs/node@0.16.8': + resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==} + engines: {node: '>=18.18.0'} + + '@humanfs/types@0.15.0': + resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==} engines: {node: '>=18.18.0'} '@humanwhocodes/module-importer@1.0.1': @@ -5020,10 +5027,9 @@ packages: '@webassemblyjs/wast-printer@1.14.1': resolution: {integrity: sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==} - '@xmldom/xmldom@0.8.13': - resolution: {integrity: sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==} + '@xmldom/xmldom@0.8.15': + resolution: {integrity: sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==} engines: {node: '>=10.0.0'} - deprecated: this version has critical issues, please update to the latest version '@xtuc/ieee754@1.2.0': resolution: {integrity: sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==} @@ -5406,20 +5412,11 @@ packages: base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} - baseline-browser-mapping@2.11.12: - resolution: {integrity: sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA==} - engines: {node: '>=6.0.0'} - hasBin: true - baseline-browser-mapping@2.11.13: resolution: {integrity: sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==} engines: {node: '>=6.0.0'} hasBin: true - baseline-browser-mapping@2.9.11: - resolution: {integrity: sha512-Sg0xJUNDU1sJNGdfGWhVHX0kkZ+HWcvmVymJbj6NSgZZmW/8S9Y2HQ5euytnIgakgxN6papOAWiwDo1ctFDcoQ==} - hasBin: true - basic-auth@2.0.1: resolution: {integrity: sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==} engines: {node: '>= 0.8'} @@ -5484,16 +5481,6 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - browserslist@4.28.1: - resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==} - engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} - hasBin: true - - browserslist@4.28.7: - resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==} - engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} - hasBin: true - browserslist@4.28.8: resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} @@ -5575,9 +5562,6 @@ packages: caniuse-api@3.0.0: resolution: {integrity: sha512-bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==} - caniuse-lite@1.0.30001762: - resolution: {integrity: sha512-PxZwGNvH7Ak8WX5iXzoK1KPZttBXNPuaOvI2ZYU7NrlM+d9Ov+TUvlLOBNGzVXAntMSMMlJPd+jY6ovrVjSmUw==} - caniuse-lite@1.0.30001809: resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==} @@ -6342,12 +6326,6 @@ packages: electron-publish@26.15.3: resolution: {integrity: sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==} - electron-to-chromium@1.5.267: - resolution: {integrity: sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==} - - electron-to-chromium@1.5.402: - resolution: {integrity: sha512-/oOpMaPT6Yg+6/1XQhyIPlzgj7Ye9zf+nNM2Uh6OcE2G2oNptWazFa+qB2Pdqqbsc9KnIDzgAntoYN0dbwOXwA==} - electron-to-chromium@1.5.403: resolution: {integrity: sha512-MQsYmdaLzvaCX5j+ZZBr5Fm6uCCnPQcRtlvmvRlWqrXy+BH2O4ffXIAScF+JQznQWB9brWp4lSD9Z4yNmaf2BA==} @@ -8713,9 +8691,6 @@ packages: node-mock-http@1.0.4: resolution: {integrity: sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ==} - node-releases@2.0.27: - resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==} - node-releases@2.0.53: resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==} engines: {node: '>=18'} @@ -9367,8 +9342,8 @@ packages: resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==} engines: {node: '>=4'} - postcss-selector-parser@6.1.2: - resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==} + postcss-selector-parser@6.1.4: + resolution: {integrity: sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==} engines: {node: '>=4'} postcss-selector-parser@7.1.5: @@ -10946,17 +10921,11 @@ packages: unzipper@0.12.5: resolution: {integrity: sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} - hasBin: true - peerDependencies: - browserslist: '>= 4.21.0' - update-browserslist-db@1.3.0: resolution: {integrity: sha512-x/M6q3w4Ybp91CNaS4S69UnliqR3BzRpOT6LWbksjth0S/+jhfaPJsWjt/TewpT8j9eLIojUf5jr29WextHroA==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: 4.28.8 uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} @@ -11781,7 +11750,7 @@ snapshots: '@inquirer/confirm': 5.1.21(@types/node@20.19.9) '@vitejs/plugin-basic-ssl': 2.1.4(vite@7.3.6(patch_hash=215b6585a9c92fa68c096d500f4676983200307b1e64c1321e20ccbd50bbc8f3)(@types/node@20.19.9)(jiti@1.21.7)(less@4.5.1)(lightningcss@1.33.0)(sass-embedded@1.100.0)(sass@1.97.3)(terser@5.49.2)(tsx@4.23.12)(yaml@2.9.0)) beasties: 0.4.1 - browserslist: 4.28.7 + browserslist: 4.28.8 esbuild: 0.28.1 https-proxy-agent: 7.0.6 istanbul-lib-instrument: 6.0.3 @@ -13441,13 +13410,18 @@ snapshots: dependencies: hono: 4.12.34 - '@humanfs/core@0.19.1': {} - - '@humanfs/node@0.16.7': + '@humanfs/core@0.19.2': dependencies: - '@humanfs/core': 0.19.1 + '@humanfs/types': 0.15.0 + + '@humanfs/node@0.16.8': + dependencies: + '@humanfs/core': 0.19.2 + '@humanfs/types': 0.15.0 '@humanwhocodes/retry': 0.4.3 + '@humanfs/types@0.15.0': {} + '@humanwhocodes/module-importer@1.0.1': {} '@humanwhocodes/retry@0.4.3': {} @@ -16526,7 +16500,7 @@ snapshots: '@webassemblyjs/ast': 1.14.1 '@xtuc/long': 4.2.2 - '@xmldom/xmldom@0.8.13': {} + '@xmldom/xmldom@0.8.15': {} '@xtuc/ieee754@1.2.0': {} @@ -17100,12 +17074,8 @@ snapshots: base64-js@1.5.1: {} - baseline-browser-mapping@2.11.12: {} - baseline-browser-mapping@2.11.13: {} - baseline-browser-mapping@2.9.11: {} - basic-auth@2.0.1: dependencies: safe-buffer: 5.1.2 @@ -17202,22 +17172,6 @@ snapshots: dependencies: fill-range: 7.1.1 - browserslist@4.28.1: - dependencies: - baseline-browser-mapping: 2.9.11 - caniuse-lite: 1.0.30001762 - electron-to-chromium: 1.5.267 - node-releases: 2.0.27 - update-browserslist-db: 1.2.3(browserslist@4.28.1) - - browserslist@4.28.7: - dependencies: - baseline-browser-mapping: 2.11.12 - caniuse-lite: 1.0.30001809 - electron-to-chromium: 1.5.402 - node-releases: 2.0.53 - update-browserslist-db: 1.3.0(browserslist@4.28.7) - browserslist@4.28.8: dependencies: baseline-browser-mapping: 2.11.13 @@ -17332,8 +17286,6 @@ snapshots: lodash.memoize: 4.1.2 lodash.uniq: 4.5.0 - caniuse-lite@1.0.30001762: {} - caniuse-lite@1.0.30001809: {} ccount@2.0.1: {} @@ -17992,10 +17944,6 @@ snapshots: transitivePeerDependencies: - supports-color - electron-to-chromium@1.5.267: {} - - electron-to-chromium@1.5.402: {} - electron-to-chromium@1.5.403: {} electron-updater@6.8.9: @@ -18407,7 +18355,7 @@ snapshots: '@eslint/eslintrc': 3.3.6 '@eslint/js': 9.39.2 '@eslint/plugin-kit': 0.4.1 - '@humanfs/node': 0.16.7 + '@humanfs/node': 0.16.8 '@humanwhocodes/module-importer': 1.0.1 '@humanwhocodes/retry': 0.4.3 '@types/estree': 1.0.8 @@ -21047,14 +20995,14 @@ snapshots: dependencies: '@babel/runtime': 7.29.7 '@videojs/vhs-utils': 3.0.5 - '@xmldom/xmldom': 0.8.13 + '@xmldom/xmldom': 0.8.15 global: 4.4.0 mpd-parser@1.4.0: dependencies: '@babel/runtime': 7.29.7 '@videojs/vhs-utils': 4.1.2 - '@xmldom/xmldom': 0.8.13 + '@xmldom/xmldom': 0.8.15 global: 4.4.0 mpegts.js@1.8.1: @@ -21203,8 +21151,6 @@ snapshots: node-mock-http@1.0.4: {} - node-releases@2.0.27: {} - node-releases@2.0.53: {} nopt@9.0.0: @@ -21799,7 +21745,7 @@ snapshots: plist@3.1.0: dependencies: - '@xmldom/xmldom': 0.8.13 + '@xmldom/xmldom': 0.8.15 base64-js: 1.5.1 xmlbuilder: 15.1.1 @@ -21958,7 +21904,7 @@ snapshots: postcss-nested@6.2.0(postcss@8.5.26): dependencies: postcss: 8.5.26 - postcss-selector-parser: 6.1.2 + postcss-selector-parser: 6.1.4 postcss-normalize-charset@7.0.3(postcss@8.5.26): dependencies: @@ -22031,7 +21977,7 @@ snapshots: cssesc: 3.0.0 util-deprecate: 1.0.2 - postcss-selector-parser@6.1.2: + postcss-selector-parser@6.1.4: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -23318,7 +23264,7 @@ snapshots: postcss-js: 4.1.0(postcss@8.5.26) postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.26)(tsx@4.23.12)(yaml@2.9.0) postcss-nested: 6.2.0(postcss@8.5.26) - postcss-selector-parser: 6.1.2 + postcss-selector-parser: 6.1.4 resolve: 1.22.11 sucrase: 3.35.1 transitivePeerDependencies: @@ -23834,18 +23780,6 @@ snapshots: graceful-fs: 4.2.11 node-int64: 0.4.0 - update-browserslist-db@1.2.3(browserslist@4.28.1): - dependencies: - browserslist: 4.28.1 - escalade: 3.2.0 - picocolors: 1.1.1 - - update-browserslist-db@1.3.0(browserslist@4.28.7): - dependencies: - browserslist: 4.28.7 - escalade: 3.2.0 - picocolors: 1.1.1 - update-browserslist-db@1.3.0(browserslist@4.28.8): dependencies: browserslist: 4.28.8 @@ -24113,7 +24047,7 @@ snapshots: '@webassemblyjs/wasm-parser': 1.14.1 acorn: 8.15.0 acorn-import-phases: 1.0.4(acorn@8.15.0) - browserslist: 4.28.1 + browserslist: 4.28.8 chrome-trace-event: 1.0.4 enhanced-resolve: 5.18.4 es-module-lexer: 2.0.0