From 0ce607495ab8a4f96c26c8a7d8125e4950e0fb70 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:28:45 +0000 Subject: [PATCH 1/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20bcrypt=20DoS=20vulnerability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packages/shared/src/schemas/auth.test.ts | 14 ++++++++++++++ packages/shared/src/schemas/auth.ts | 4 ++-- .../src/app/api/password-reset/[token]/route.ts | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/packages/shared/src/schemas/auth.test.ts b/packages/shared/src/schemas/auth.test.ts index 08308f41..f50cc24f 100644 --- a/packages/shared/src/schemas/auth.test.ts +++ b/packages/shared/src/schemas/auth.test.ts @@ -19,6 +19,13 @@ describe('LoginRequestSchema', () => { LoginRequestSchema.safeParse({ email: 'a@b.com', password: '1234567' }).success, ).toBe(false) }) + + it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => { + const longPassword = 'a'.repeat(1025) + expect( + LoginRequestSchema.safeParse({ email: 'a@b.com', password: longPassword }).success, + ).toBe(false) + }) }) describe('RegisterRequestSchema', () => { @@ -33,6 +40,13 @@ describe('RegisterRequestSchema', () => { RegisterRequestSchema.safeParse({ email: 'a@b.com', password: '12345678', name: 'k' }).success, ).toBe(true) }) + + it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => { + const longPassword = 'a'.repeat(1025) + expect( + RegisterRequestSchema.safeParse({ email: 'a@b.com', password: longPassword, name: 'k' }).success, + ).toBe(false) + }) }) describe('ExchangeRequestSchema', () => { diff --git a/packages/shared/src/schemas/auth.ts b/packages/shared/src/schemas/auth.ts index abbc0063..fe3f8a51 100644 --- a/packages/shared/src/schemas/auth.ts +++ b/packages/shared/src/schemas/auth.ts @@ -2,12 +2,12 @@ import { z } from 'zod' export const LoginRequestSchema = z.object({ email: z.string().email(), - password: z.string().min(8), + password: z.string().min(8).max(1024), }) export const RegisterRequestSchema = z.object({ email: z.string().email(), - password: z.string().min(8), + password: z.string().min(8).max(1024), name: z.string().min(1), }) diff --git a/packages/web/src/app/api/password-reset/[token]/route.ts b/packages/web/src/app/api/password-reset/[token]/route.ts index 19661481..6741a802 100644 --- a/packages/web/src/app/api/password-reset/[token]/route.ts +++ b/packages/web/src/app/api/password-reset/[token]/route.ts @@ -12,8 +12,8 @@ export const dynamic = 'force-dynamic' const ResetPasswordSchema = z .object({ - password: z.string().min(8), - passwordConfirmation: z.string().min(8), + password: z.string().min(8).max(1024), + passwordConfirmation: z.string().min(8).max(1024), }) .refine((value) => value.password === value.passwordConfirmation, { path: ['passwordConfirmation'], From 8380b3a87427bb740c5a9bef886ef4ee2a8652c0 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:44:48 +0000 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20bcrypt=20DoS=20vulnerability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- package.json | 10 +++++- pnpm-lock.yaml | 86 ++++++++++++++++++++++++++++++-------------------- 2 files changed, 61 insertions(+), 35 deletions(-) diff --git a/package.json b/package.json index 87305947..8bb31884 100644 --- a/package.json +++ b/package.json @@ -11,6 +11,7 @@ }, "devDependencies": { "@eslint/eslintrc": "^3", + "brace-expansion": "^1.1.16", "eslint": "^9", "turbo": "^2.9.16", "typescript-eslint": "^8" @@ -21,7 +22,14 @@ "@babel/core": "7.29.7", "esbuild": "0.28.1", "hono": "4.12.25", - "js-yaml": "4.2.0" + "js-yaml": "4.3.0", + "body-parser@>=2.0.0 <2.3.0": ">=2.3.0", + "hono@>=4.3.3 <4.12.27": ">=4.12.27", + "@hono/node-server@<2.0.5": ">=2.0.5", + "hono@>=4.11.8 <4.12.27": ">=4.12.27", + "hono@>=4.0.0 <4.12.27": ">=4.12.27", + "fast-uri@>=3.0.0 <3.1.3": ">=3.1.3", + "minimatch@3.1.5>brace-expansion": "1.1.11" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 20e4c5a9..c66bc2e5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,7 +8,14 @@ overrides: '@babel/core': 7.29.7 esbuild: 0.28.1 hono: 4.12.25 - js-yaml: 4.2.0 + js-yaml: 4.3.0 + body-parser@>=2.0.0 <2.3.0: '>=2.3.0' + hono@>=4.3.3 <4.12.27: '>=4.12.27' + '@hono/node-server@<2.0.5': '>=2.0.5' + hono@>=4.11.8 <4.12.27: '>=4.12.27' + hono@>=4.0.0 <4.12.27: '>=4.12.27' + fast-uri@>=3.0.0 <3.1.3: '>=3.1.3' + minimatch@3.1.5>brace-expansion: 1.1.11 pnpmfileChecksum: qsp27c6veblwg3gxusbbzrumtm @@ -19,6 +26,9 @@ importers: '@eslint/eslintrc': specifier: ^3 version: 3.3.5 + brace-expansion: + specifier: ^1.1.16 + version: 1.1.16 eslint: specifier: ^9 version: 9.39.4(jiti@2.6.1) @@ -689,11 +699,11 @@ packages: '@floating-ui/utils@0.2.11': resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==} - '@hono/node-server@1.19.14': - resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} - engines: {node: '>=18.14.1'} + '@hono/node-server@2.0.11': + resolution: {integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==} + engines: {node: '>=20'} peerDependencies: - hono: 4.12.25 + hono: '>=4.12.27' '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} @@ -1928,18 +1938,21 @@ packages: bidi-js@1.0.3: resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==} - body-parser@2.2.2: - resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==} + body-parser@2.3.0: + resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} - brace-expansion@1.1.15: - resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==} + brace-expansion@1.1.11: + resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==} + + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} brace-expansion@2.1.2: resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -2655,8 +2668,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@4.1.1: + resolution: {integrity: sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2871,8 +2884,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.25: - resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} + hono@4.12.31: + resolution: {integrity: sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -3180,8 +3193,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsdom@29.1.1: @@ -5184,7 +5197,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.0 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -5220,9 +5233,9 @@ snapshots: '@floating-ui/utils@0.2.11': {} - '@hono/node-server@1.19.14(hono@4.12.25)': + '@hono/node-server@2.0.11(hono@4.12.31)': dependencies: - hono: 4.12.25 + hono: 4.12.31 '@humanfs/core@0.19.1': {} @@ -5516,7 +5529,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.25) + '@hono/node-server': 2.0.11(hono@4.12.31) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -5526,7 +5539,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.25 + hono: 4.12.31 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6207,7 +6220,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 4.1.1 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -6338,10 +6351,10 @@ snapshots: dependencies: require-from-string: 2.0.2 - body-parser@2.2.2: + body-parser@2.3.0: dependencies: bytes: 3.1.2 - content-type: 1.0.5 + content-type: 2.0.0 debug: 4.4.3 http-errors: 2.0.1 iconv-lite: 0.7.2 @@ -6352,7 +6365,12 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@1.1.15: + brace-expansion@1.1.11: + dependencies: + balanced-match: 1.0.2 + concat-map: 0.0.1 + + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 @@ -6361,7 +6379,7 @@ snapshots: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.6: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -6529,7 +6547,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.0 parse-json: 5.2.0 optionalDependencies: typescript: 5.9.3 @@ -7152,7 +7170,7 @@ snapshots: express@5.2.1: dependencies: accepts: 2.0.0 - body-parser: 2.2.2 + body-parser: 2.3.0 content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -7220,7 +7238,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.2: {} + fast-uri@4.1.1: {} fast-wrap-ansi@0.2.2: dependencies: @@ -7458,7 +7476,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.25: {} + hono@4.12.31: {} html-encoding-sniffer@6.0.0(@noble/hashes@1.8.0): dependencies: @@ -7737,7 +7755,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.2.0: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -8296,11 +8314,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.15 + brace-expansion: 1.1.11 minimatch@9.0.9: dependencies: From e8421e016a840f60ef87d63a2cc31b55af9ddb49 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:02:05 +0000 Subject: [PATCH 3/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20bcrypt=20DoS=20vulnerability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- package.json | 20 ++++++++++-------- pnpm-lock.yaml | 56 ++++++++++++++++++++++---------------------------- 2 files changed, 35 insertions(+), 41 deletions(-) diff --git a/package.json b/package.json index 8bb31884..afa62d80 100644 --- a/package.json +++ b/package.json @@ -11,7 +11,6 @@ }, "devDependencies": { "@eslint/eslintrc": "^3", - "brace-expansion": "^1.1.16", "eslint": "^9", "turbo": "^2.9.16", "typescript-eslint": "^8" @@ -22,14 +21,17 @@ "@babel/core": "7.29.7", "esbuild": "0.28.1", "hono": "4.12.25", - "js-yaml": "4.3.0", - "body-parser@>=2.0.0 <2.3.0": ">=2.3.0", - "hono@>=4.3.3 <4.12.27": ">=4.12.27", - "@hono/node-server@<2.0.5": ">=2.0.5", - "hono@>=4.11.8 <4.12.27": ">=4.12.27", - "hono@>=4.0.0 <4.12.27": ">=4.12.27", - "fast-uri@>=3.0.0 <3.1.3": ">=3.1.3", - "minimatch@3.1.5>brace-expansion": "1.1.11" + "js-yaml": "4.2.0", + "minimatch@3.1.5>brace-expansion": "1.1.11", + "brace-expansion@<1.1.16": "1.1.16", + "brace-expansion@>=3.0.0 <5.0.7": "5.0.7", + "js-yaml@>=4.0.0 <4.3.0": "4.3.0", + "body-parser@>=2.0.0 <2.3.0": "2.3.0", + "hono@>=4.3.3 <4.12.27": "4.12.27", + "@hono/node-server@<2.0.5": "2.0.5", + "hono@>=4.11.8 <4.12.27": "4.12.27", + "hono@>=4.0.0 <4.12.27": "4.12.27", + "fast-uri@>=3.0.0 <3.1.3": "3.1.3" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c66bc2e5..b37c0e56 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,14 +8,17 @@ overrides: '@babel/core': 7.29.7 esbuild: 0.28.1 hono: 4.12.25 - js-yaml: 4.3.0 - body-parser@>=2.0.0 <2.3.0: '>=2.3.0' - hono@>=4.3.3 <4.12.27: '>=4.12.27' - '@hono/node-server@<2.0.5': '>=2.0.5' - hono@>=4.11.8 <4.12.27: '>=4.12.27' - hono@>=4.0.0 <4.12.27: '>=4.12.27' - fast-uri@>=3.0.0 <3.1.3: '>=3.1.3' + js-yaml: 4.2.0 minimatch@3.1.5>brace-expansion: 1.1.11 + brace-expansion@<1.1.16: 1.1.16 + brace-expansion@>=3.0.0 <5.0.7: 5.0.7 + js-yaml@>=4.0.0 <4.3.0: 4.3.0 + body-parser@>=2.0.0 <2.3.0: 2.3.0 + hono@>=4.3.3 <4.12.27: 4.12.27 + '@hono/node-server@<2.0.5': 2.0.5 + hono@>=4.11.8 <4.12.27: 4.12.27 + hono@>=4.0.0 <4.12.27: 4.12.27 + fast-uri@>=3.0.0 <3.1.3: 3.1.3 pnpmfileChecksum: qsp27c6veblwg3gxusbbzrumtm @@ -26,9 +29,6 @@ importers: '@eslint/eslintrc': specifier: ^3 version: 3.3.5 - brace-expansion: - specifier: ^1.1.16 - version: 1.1.16 eslint: specifier: ^9 version: 9.39.4(jiti@2.6.1) @@ -699,11 +699,11 @@ packages: '@floating-ui/utils@0.2.11': resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==} - '@hono/node-server@2.0.11': - resolution: {integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==} + '@hono/node-server@2.0.5': + resolution: {integrity: sha512-yQFvDmyDo3y6rEOJZDUYPJ49DIKTPpIk4kGvm40xx4Ejne0Pu9a1+exxPN+C1UppWK/WGZX9F++/Xs231tE86g==} engines: {node: '>=20'} peerDependencies: - hono: '>=4.12.27' + hono: 4.12.27 '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} @@ -1945,9 +1945,6 @@ packages: brace-expansion@1.1.11: resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==} - brace-expansion@1.1.16: - resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@2.1.2: resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} @@ -2668,8 +2665,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@4.1.1: - resolution: {integrity: sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==} + fast-uri@3.1.3: + resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2884,8 +2881,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.31: - resolution: {integrity: sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==} + hono@4.12.27: + resolution: {integrity: sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -5233,9 +5230,9 @@ snapshots: '@floating-ui/utils@0.2.11': {} - '@hono/node-server@2.0.11(hono@4.12.31)': + '@hono/node-server@2.0.5(hono@4.12.27)': dependencies: - hono: 4.12.31 + hono: 4.12.27 '@humanfs/core@0.19.1': {} @@ -5529,7 +5526,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': dependencies: - '@hono/node-server': 2.0.11(hono@4.12.31) + '@hono/node-server': 2.0.5(hono@4.12.27) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -5539,7 +5536,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.31 + hono: 4.12.27 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6220,7 +6217,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 4.1.1 + fast-uri: 3.1.3 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -6370,11 +6367,6 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@1.1.16: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - brace-expansion@2.1.2: dependencies: balanced-match: 1.0.2 @@ -7238,7 +7230,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@4.1.1: {} + fast-uri@3.1.3: {} fast-wrap-ansi@0.2.2: dependencies: @@ -7476,7 +7468,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.31: {} + hono@4.12.27: {} html-encoding-sniffer@6.0.0(@noble/hashes@1.8.0): dependencies: From 65fd9831d381ec92bf28f44e9d0f5e3b80dd16db Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:23:38 +0000 Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20bcrypt=20DoS=20vulnerability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/osvscanner.yml | 4 +- package.json | 12 +---- pnpm-lock.yaml | 76 ++++++++++++++------------------ 3 files changed, 36 insertions(+), 56 deletions(-) diff --git a/.github/workflows/osvscanner.yml b/.github/workflows/osvscanner.yml index d4c1e582..0aa97aa4 100644 --- a/.github/workflows/osvscanner.yml +++ b/.github/workflows/osvscanner.yml @@ -15,9 +15,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + uses: actions/checkout@v4 - name: Run OSV-Scanner - uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 + uses: google/osv-scanner-action/osv-scanner-action@v1.9.0 with: scan-args: |- --recursive diff --git a/package.json b/package.json index afa62d80..87305947 100644 --- a/package.json +++ b/package.json @@ -21,17 +21,7 @@ "@babel/core": "7.29.7", "esbuild": "0.28.1", "hono": "4.12.25", - "js-yaml": "4.2.0", - "minimatch@3.1.5>brace-expansion": "1.1.11", - "brace-expansion@<1.1.16": "1.1.16", - "brace-expansion@>=3.0.0 <5.0.7": "5.0.7", - "js-yaml@>=4.0.0 <4.3.0": "4.3.0", - "body-parser@>=2.0.0 <2.3.0": "2.3.0", - "hono@>=4.3.3 <4.12.27": "4.12.27", - "@hono/node-server@<2.0.5": "2.0.5", - "hono@>=4.11.8 <4.12.27": "4.12.27", - "hono@>=4.0.0 <4.12.27": "4.12.27", - "fast-uri@>=3.0.0 <3.1.3": "3.1.3" + "js-yaml": "4.2.0" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b37c0e56..20e4c5a9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,16 +9,6 @@ overrides: esbuild: 0.28.1 hono: 4.12.25 js-yaml: 4.2.0 - minimatch@3.1.5>brace-expansion: 1.1.11 - brace-expansion@<1.1.16: 1.1.16 - brace-expansion@>=3.0.0 <5.0.7: 5.0.7 - js-yaml@>=4.0.0 <4.3.0: 4.3.0 - body-parser@>=2.0.0 <2.3.0: 2.3.0 - hono@>=4.3.3 <4.12.27: 4.12.27 - '@hono/node-server@<2.0.5': 2.0.5 - hono@>=4.11.8 <4.12.27: 4.12.27 - hono@>=4.0.0 <4.12.27: 4.12.27 - fast-uri@>=3.0.0 <3.1.3: 3.1.3 pnpmfileChecksum: qsp27c6veblwg3gxusbbzrumtm @@ -699,11 +689,11 @@ packages: '@floating-ui/utils@0.2.11': resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==} - '@hono/node-server@2.0.5': - resolution: {integrity: sha512-yQFvDmyDo3y6rEOJZDUYPJ49DIKTPpIk4kGvm40xx4Ejne0Pu9a1+exxPN+C1UppWK/WGZX9F++/Xs231tE86g==} - engines: {node: '>=20'} + '@hono/node-server@1.19.14': + resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} + engines: {node: '>=18.14.1'} peerDependencies: - hono: 4.12.27 + hono: 4.12.25 '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} @@ -1938,18 +1928,18 @@ packages: bidi-js@1.0.3: resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.2.2: + resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==} engines: {node: '>=18'} - brace-expansion@1.1.11: - resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==} + brace-expansion@1.1.15: + resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==} brace-expansion@2.1.2: resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} + brace-expansion@5.0.6: + resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -2665,8 +2655,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.3: - resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==} + fast-uri@3.1.2: + resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -2881,8 +2871,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.27: - resolution: {integrity: sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==} + hono@4.12.25: + resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -3190,8 +3180,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.2.0: + resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} hasBin: true jsdom@29.1.1: @@ -5194,7 +5184,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.2.0 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -5230,9 +5220,9 @@ snapshots: '@floating-ui/utils@0.2.11': {} - '@hono/node-server@2.0.5(hono@4.12.27)': + '@hono/node-server@1.19.14(hono@4.12.25)': dependencies: - hono: 4.12.27 + hono: 4.12.25 '@humanfs/core@0.19.1': {} @@ -5526,7 +5516,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': dependencies: - '@hono/node-server': 2.0.5(hono@4.12.27) + '@hono/node-server': 1.19.14(hono@4.12.25) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -5536,7 +5526,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.27 + hono: 4.12.25 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6217,7 +6207,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.3 + fast-uri: 3.1.2 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -6348,10 +6338,10 @@ snapshots: dependencies: require-from-string: 2.0.2 - body-parser@2.3.0: + body-parser@2.2.2: dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 1.0.5 debug: 4.4.3 http-errors: 2.0.1 iconv-lite: 0.7.2 @@ -6362,7 +6352,7 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@1.1.11: + brace-expansion@1.1.15: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 @@ -6371,7 +6361,7 @@ snapshots: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.7: + brace-expansion@5.0.6: dependencies: balanced-match: 4.0.4 @@ -6539,7 +6529,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.2.0 parse-json: 5.2.0 optionalDependencies: typescript: 5.9.3 @@ -7162,7 +7152,7 @@ snapshots: express@5.2.1: dependencies: accepts: 2.0.0 - body-parser: 2.3.0 + body-parser: 2.2.2 content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -7230,7 +7220,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.3: {} + fast-uri@3.1.2: {} fast-wrap-ansi@0.2.2: dependencies: @@ -7468,7 +7458,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.27: {} + hono@4.12.25: {} html-encoding-sniffer@6.0.0(@noble/hashes@1.8.0): dependencies: @@ -7747,7 +7737,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.3.0: + js-yaml@4.2.0: dependencies: argparse: 2.0.1 @@ -8306,11 +8296,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.6 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.11 + brace-expansion: 1.1.15 minimatch@9.0.9: dependencies: