From be1d88fe9c41488bd4c35e1267ae817b190843d9 Mon Sep 17 00:00:00 2001 From: Marcel Wege Date: Mon, 27 Jul 2026 06:49:20 +0200 Subject: [PATCH 1/3] chore(deps,middleware): bump argon2, pdf-parse (major), @anthropic-ai/sdk - argon2 0.43.1 -> 0.45.1 (Dependabot PR #515) - pdf-parse 1.1.1 -> 2.4.5 -- MAJOR (Dependabot PR #516). v2 is a full rewrite: no longer a callable default export, now a class API (new PDFParse({ data }).getText()). Updated attachmentExtract.ts's import/call site accordingly, with a best-effort destroy() in finally to free the pdf.js worker/canvas. - @anthropic-ai/sdk 0.111.0 -> 0.115.0 (Dependabot PR #520) --- middleware/package-lock.json | 352 ++++++++++++++++-- middleware/package.json | 8 +- .../harness-orchestrator/package.json | 2 +- .../src/attachmentExtract.ts | 20 +- 4 files changed, 340 insertions(+), 42 deletions(-) diff --git a/middleware/package-lock.json b/middleware/package-lock.json index 4ad08247..c2d593f1 100644 --- a/middleware/package-lock.json +++ b/middleware/package-lock.json @@ -13,15 +13,15 @@ "packages/*" ], "dependencies": { - "@anthropic-ai/sdk": "^0.111.0", + "@anthropic-ai/sdk": "^0.115.0", "@aws-sdk/client-s3": "^3.1075.0", "@azure/msal-node": "^5.3.1", "@microsoft/microsoft-graph-client": "^3.0.7", "@types/better-sqlite3": "^7.6.13", "@types/cookie-parser": "^1.4.10", "@types/multer": "^2.1.0", - "@types/yauzl": "^2.10.3", - "argon2": "^0.43.1", + "@types/yauzl": "^3.4.0", + "argon2": "^0.45.1", "better-sqlite3": "^12.11.1", "bonjour-service": "^1.4.3", "botbuilder": "^4.23.3", @@ -48,7 +48,7 @@ "devDependencies": { "@eslint/js": "^10.0.1", "@types/express": "^5.0.6", - "@types/node": "^25.9.1", + "@types/node": "^26.1.1", "@types/pg": "^8.11.10", "@types/ws": "^8.5.13", "@types/yazl": "^3.3.1", @@ -63,9 +63,9 @@ } }, "node_modules/@anthropic-ai/sdk": { - "version": "0.111.0", - "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.111.0.tgz", - "integrity": "sha512-1hUqKi+uJQoS5X90+InwHbFAXMvgq0DnsC5hVLEeSRaODiU5WvmqDAcVCmGS2wC0pN9Z8jtWCbWw7JLzeDdm/Q==", + "version": "0.115.0", + "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.115.0.tgz", + "integrity": "sha512-BJrFIVyjNuU8lfDyIJTvlRYzgQg+zEl78BxE7fq8esULsGz9IRQvGtW5spq3tydmtjQb/GFdooKGdGsetpx+lQ==", "license": "MIT", "dependencies": { "json-schema-to-ts": "^3.1.1", @@ -619,6 +619,12 @@ "tslib": "^2.4.0" } }, + "node_modules/@epic-web/invariant": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/@epic-web/invariant/-/invariant-1.0.0.tgz", + "integrity": "sha512-lrTPqgvfFQtR/eY/qkIzp98OGdNJu0m5ji3q/nJI8v3SXkRKEnWiOxMmbvcSoAIzv/cGiuvRy57k4suKQSAdwA==", + "license": "MIT" + }, "node_modules/@esbuild/aix-ppc64": { "version": "0.28.1", "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz", @@ -1896,6 +1902,190 @@ } } }, + "node_modules/@napi-rs/canvas": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas/-/canvas-0.1.80.tgz", + "integrity": "sha512-DxuT1ClnIPts1kQx8FBmkk4BQDTfI5kIzywAaMjQSXfNnra5UFU9PwurXrl+Je3bJ6BGsp/zmshVVFbCmyI+ww==", + "license": "MIT", + "workspaces": [ + "e2e/*" + ], + "engines": { + "node": ">= 10" + }, + "optionalDependencies": { + "@napi-rs/canvas-android-arm64": "0.1.80", + "@napi-rs/canvas-darwin-arm64": "0.1.80", + "@napi-rs/canvas-darwin-x64": "0.1.80", + "@napi-rs/canvas-linux-arm-gnueabihf": "0.1.80", + "@napi-rs/canvas-linux-arm64-gnu": "0.1.80", + "@napi-rs/canvas-linux-arm64-musl": "0.1.80", + "@napi-rs/canvas-linux-riscv64-gnu": "0.1.80", + "@napi-rs/canvas-linux-x64-gnu": "0.1.80", + "@napi-rs/canvas-linux-x64-musl": "0.1.80", + "@napi-rs/canvas-win32-x64-msvc": "0.1.80" + } + }, + "node_modules/@napi-rs/canvas-android-arm64": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-android-arm64/-/canvas-android-arm64-0.1.80.tgz", + "integrity": "sha512-sk7xhN/MoXeuExlggf91pNziBxLPVUqF2CAVnB57KLG/pz7+U5TKG8eXdc3pm0d7Od0WreB6ZKLj37sX9muGOQ==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-darwin-arm64": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-arm64/-/canvas-darwin-arm64-0.1.80.tgz", + "integrity": "sha512-O64APRTXRUiAz0P8gErkfEr3lipLJgM6pjATwavZ22ebhjYl/SUbpgM0xcWPQBNMP1n29afAC/Us5PX1vg+JNQ==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-darwin-x64": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-darwin-x64/-/canvas-darwin-x64-0.1.80.tgz", + "integrity": "sha512-FqqSU7qFce0Cp3pwnTjVkKjjOtxMqRe6lmINxpIZYaZNnVI0H5FtsaraZJ36SiTHNjZlUB69/HhxNDT1Aaa9vA==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-arm-gnueabihf": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm-gnueabihf/-/canvas-linux-arm-gnueabihf-0.1.80.tgz", + "integrity": "sha512-eyWz0ddBDQc7/JbAtY4OtZ5SpK8tR4JsCYEZjCE3dI8pqoWUC8oMwYSBGCYfsx2w47cQgQCgMVRVTFiiO38hHQ==", + "cpu": [ + "arm" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-arm64-gnu": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-gnu/-/canvas-linux-arm64-gnu-0.1.80.tgz", + "integrity": "sha512-qwA63t8A86bnxhuA/GwOkK3jvb+XTQaTiVML0vAWoHyoZYTjNs7BzoOONDgTnNtr8/yHrq64XXzUoLqDzU+Uuw==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-arm64-musl": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-arm64-musl/-/canvas-linux-arm64-musl-0.1.80.tgz", + "integrity": "sha512-1XbCOz/ymhj24lFaIXtWnwv/6eFHXDrjP0jYkc6iHQ9q8oXKzUX1Lc6bu+wuGiLhGh2GS/2JlfORC5ZcXimRcg==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-riscv64-gnu": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-riscv64-gnu/-/canvas-linux-riscv64-gnu-0.1.80.tgz", + "integrity": "sha512-XTzR125w5ZMs0lJcxRlS1K3P5RaZ9RmUsPtd1uGt+EfDyYMu4c6SEROYsxyatbbu/2+lPe7MPHOO/0a0x7L/gw==", + "cpu": [ + "riscv64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-x64-gnu": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-0.1.80.tgz", + "integrity": "sha512-BeXAmhKg1kX3UCrJsYbdQd3hIMDH/K6HnP/pG2LuITaXhXBiNdh//TVVVVCBbJzVQaV5gK/4ZOCMrQW9mvuTqA==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-linux-x64-musl": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-linux-x64-musl/-/canvas-linux-x64-musl-0.1.80.tgz", + "integrity": "sha512-x0XvZWdHbkgdgucJsRxprX/4o4sEed7qo9rCQA9ugiS9qE2QvP0RIiEugtZhfLH3cyI+jIRFJHV4Fuz+1BHHMg==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10" + } + }, + "node_modules/@napi-rs/canvas-win32-x64-msvc": { + "version": "0.1.80", + "resolved": "https://registry.npmjs.org/@napi-rs/canvas-win32-x64-msvc/-/canvas-win32-x64-msvc-0.1.80.tgz", + "integrity": "sha512-Z8jPsM6df5V8B1HrCHB05+bDiCxjE9QA//3YrkKIdVDEwn5RKaqOxCJDRJkl48cJbylcrJbW4HxZbTte8juuPg==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10" + } + }, "node_modules/@napi-rs/wasm-runtime": { "version": "1.1.6", "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz", @@ -2579,12 +2769,12 @@ } }, "node_modules/@types/node": { - "version": "25.9.5", - "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz", - "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==", + "version": "26.1.1", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz", + "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==", "license": "MIT", "dependencies": { - "undici-types": ">=7.24.0 <7.24.7" + "undici-types": "~8.3.0" } }, "node_modules/@types/pdf-parse": { @@ -2679,9 +2869,9 @@ } }, "node_modules/@types/yauzl": { - "version": "2.10.3", - "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz", - "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==", + "version": "3.4.0", + "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-3.4.0.tgz", + "integrity": "sha512-NRPn5w6h8dhcnmx3YIRQcqMywY/+nND/uOkJessedcrowO3C0AssHp3tMJpxKAwOhFOo0OV1y9VtsC5hbKKBAw==", "license": "MIT", "dependencies": { "@types/node": "*" @@ -3253,14 +3443,15 @@ "license": "MIT" }, "node_modules/argon2": { - "version": "0.43.1", - "resolved": "https://registry.npmjs.org/argon2/-/argon2-0.43.1.tgz", - "integrity": "sha512-TfOzvDWUaQPurCT1hOwIeFNkgrAJDpbBGBGWDgzDsm11nNhImc13WhdGdCU6K7brkp8VpeY07oGtSex0Wmhg8w==", + "version": "0.45.1", + "resolved": "https://registry.npmjs.org/argon2/-/argon2-0.45.1.tgz", + "integrity": "sha512-skm+/WCjkGqCQxF7FG1LuZXM5yvbFjgbfiCGsud2oLgaDhh6b6dbH0b1EkghbM+xx4Bj8Ape+KKgixoIlWZicQ==", "hasInstallScript": true, "license": "MIT", "dependencies": { "@phc/format": "^1.0.0", - "node-addon-api": "^8.4.0", + "cross-env": "^10.1.0", + "node-addon-api": "^8.9.0", "node-gyp-build": "^4.8.4" }, "engines": { @@ -4151,6 +4342,23 @@ "node": ">=18.0" } }, + "node_modules/cross-env": { + "version": "10.1.0", + "resolved": "https://registry.npmjs.org/cross-env/-/cross-env-10.1.0.tgz", + "integrity": "sha512-GsYosgnACZTADcmEyJctkJIoqAhHjttw7RsFrVoJNXbsWWqaq6Ym+7kZjq6mS45O0jij6vtiReppKQEtqWy6Dw==", + "license": "MIT", + "dependencies": { + "@epic-web/invariant": "^1.0.0", + "cross-spawn": "^7.0.6" + }, + "bin": { + "cross-env": "dist/bin/cross-env.js", + "cross-env-shell": "dist/bin/cross-env-shell.js" + }, + "engines": { + "node": ">=20" + } + }, "node_modules/cross-fetch": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/cross-fetch/-/cross-fetch-4.1.0.tgz", @@ -4355,6 +4563,15 @@ "node": ">=10" } }, + "node_modules/docx/node_modules/@types/node": { + "version": "25.9.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz", + "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==", + "license": "MIT", + "dependencies": { + "undici-types": ">=7.24.0 <7.24.7" + } + }, "node_modules/docx/node_modules/nanoid": { "version": "5.1.16", "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz", @@ -4373,6 +4590,12 @@ "node": "^18 || >=20" } }, + "node_modules/docx/node_modules/undici-types": { + "version": "7.24.6", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", + "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "license": "MIT" + }, "node_modules/dom-serializer": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz", @@ -6691,12 +6914,6 @@ "node": "^18 || ^20 || >= 21" } }, - "node_modules/node-ensure": { - "version": "0.0.0", - "resolved": "https://registry.npmjs.org/node-ensure/-/node-ensure-0.0.0.tgz", - "integrity": "sha512-DRI60hzo2oKN1ma0ckc6nQWlHU69RH6xN0sjQTjMpChPfTYvKZdcQFfdYK2RWbJcKyUizSIy/l8OTGxMAM1QDw==", - "license": "MIT" - }, "node_modules/node-fetch": { "version": "2.7.0", "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz", @@ -6989,21 +7206,37 @@ "license": "MIT" }, "node_modules/pdf-parse": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/pdf-parse/-/pdf-parse-1.1.4.tgz", - "integrity": "sha512-XRIRcLgk6ZnUbsHsYXExMw+krrPE81hJ6FQPLdBNhhBefqIQKXu/WeTgNBGSwPrfU0v+UCEwn7AoAUOsVKHFvQ==", - "license": "MIT", + "version": "2.4.5", + "resolved": "https://registry.npmjs.org/pdf-parse/-/pdf-parse-2.4.5.tgz", + "integrity": "sha512-mHU89HGh7v+4u2ubfnevJ03lmPgQ5WU4CxAVmTSh/sxVTEDYd1er/dKS/A6vg77NX47KTEoihq8jZBLr8Cxuwg==", + "license": "Apache-2.0", "dependencies": { - "node-ensure": "^0.0.0" + "@napi-rs/canvas": "0.1.80", + "pdfjs-dist": "5.4.296" + }, + "bin": { + "pdf-parse": "bin/cli.mjs" }, "engines": { - "node": ">=6.8.1" + "node": ">=20.16.0 <21 || >=22.3.0" }, "funding": { "type": "github", "url": "https://github.com/sponsors/mehmet-kozan" } }, + "node_modules/pdfjs-dist": { + "version": "5.4.296", + "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-5.4.296.tgz", + "integrity": "sha512-DlOzet0HO7OEnmUmB6wWGJrrdvbyJKftI1bhMitK7O2N8W2gc757yyYBbINy9IDafXAV9wmKr9t7xsTaNKRG5Q==", + "license": "Apache-2.0", + "engines": { + "node": ">=20.16.0 || >=22.3.0" + }, + "optionalDependencies": { + "@napi-rs/canvas": "^0.1.80" + } + }, "node_modules/pend": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz", @@ -8322,9 +8555,9 @@ } }, "node_modules/undici-types": { - "version": "7.24.6", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", - "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "version": "8.3.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz", + "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==", "license": "MIT" }, "node_modules/universalify": { @@ -8926,6 +9159,16 @@ "ws": "^8.21.1" } }, + "packages/canvas-core/node_modules/@types/node": { + "version": "25.9.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz", + "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": ">=7.24.0 <7.24.7" + } + }, "packages/canvas-core/node_modules/typescript": { "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", @@ -8940,6 +9183,13 @@ "node": ">=14.17" } }, + "packages/canvas-core/node_modules/undici-types": { + "version": "7.24.6", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", + "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "dev": true, + "license": "MIT" + }, "packages/conductor-core": { "name": "@omadia/conductor-core", "version": "0.1.0", @@ -8952,6 +9202,16 @@ "vitest": "^4.1.10" } }, + "packages/conductor-core/node_modules/@types/node": { + "version": "25.9.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz", + "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": ">=7.24.0 <7.24.7" + } + }, "packages/conductor-core/node_modules/typescript": { "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", @@ -8966,6 +9226,13 @@ "node": ">=14.17" } }, + "packages/conductor-core/node_modules/undici-types": { + "version": "7.24.6", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", + "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "dev": true, + "license": "MIT" + }, "packages/dev-runner-shim": { "name": "@omadia/dev-runner-shim", "version": "0.1.0", @@ -8975,6 +9242,16 @@ "typescript": "^5.9.0" } }, + "packages/dev-runner-shim/node_modules/@types/node": { + "version": "25.9.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz", + "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": ">=7.24.0 <7.24.7" + } + }, "packages/dev-runner-shim/node_modules/typescript": { "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", @@ -8989,6 +9266,13 @@ "node": ">=14.17" } }, + "packages/dev-runner-shim/node_modules/undici-types": { + "version": "7.24.6", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", + "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "dev": true, + "license": "MIT" + }, "packages/harness-channel-sdk": { "name": "@omadia/channel-sdk", "version": "0.1.0", @@ -9086,7 +9370,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", "mammoth": "^1.8.0", - "pdf-parse": "^1.1.1" + "pdf-parse": "^2.4.5" }, "devDependencies": { "@types/pdf-parse": "^1.1.5" diff --git a/middleware/package.json b/middleware/package.json index 0ea85044..f25d2923 100644 --- a/middleware/package.json +++ b/middleware/package.json @@ -46,15 +46,15 @@ "description": "Omadia kernel: Anthropic Messages API orchestrator with plugin runtime, persistent memory, multi-channel ingress, and vault-backed credentials.", "license": "MIT", "dependencies": { - "@anthropic-ai/sdk": "^0.111.0", + "@anthropic-ai/sdk": "^0.115.0", "@aws-sdk/client-s3": "^3.1075.0", "@azure/msal-node": "^5.3.1", "@microsoft/microsoft-graph-client": "^3.0.7", "@types/better-sqlite3": "^7.6.13", "@types/cookie-parser": "^1.4.10", "@types/multer": "^2.1.0", - "@types/yauzl": "^2.10.3", - "argon2": "^0.43.1", + "@types/yauzl": "^3.4.0", + "argon2": "^0.45.1", "better-sqlite3": "^12.11.1", "bonjour-service": "^1.4.3", "botbuilder": "^4.23.3", @@ -81,7 +81,7 @@ "devDependencies": { "@eslint/js": "^10.0.1", "@types/express": "^5.0.6", - "@types/node": "^25.9.1", + "@types/node": "^26.1.1", "@types/pg": "^8.11.10", "@types/ws": "^8.5.13", "@types/yazl": "^3.3.1", diff --git a/middleware/packages/harness-orchestrator/package.json b/middleware/packages/harness-orchestrator/package.json index 58807b19..e62befc8 100644 --- a/middleware/packages/harness-orchestrator/package.json +++ b/middleware/packages/harness-orchestrator/package.json @@ -29,7 +29,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", "mammoth": "^1.8.0", - "pdf-parse": "^1.1.1" + "pdf-parse": "^2.4.5" }, "devDependencies": { "@types/pdf-parse": "^1.1.5" diff --git a/middleware/packages/harness-orchestrator/src/attachmentExtract.ts b/middleware/packages/harness-orchestrator/src/attachmentExtract.ts index 82c040a5..36ec19b8 100644 --- a/middleware/packages/harness-orchestrator/src/attachmentExtract.ts +++ b/middleware/packages/harness-orchestrator/src/attachmentExtract.ts @@ -11,6 +11,12 @@ * `pdf-parse`, imported dynamically so a missing/odd dependency can never * crash module load. Images are deliberately NOT text-extracted here — they * flow through the existing brand:// / vision path untouched. + * + * `pdf-parse` v2+ replaced the v1 callable-default-export API + * (`pdf(buffer) -> { text }`) with a class-based API + * (`new PDFParse({ data }).getText() -> { text }`); see the `PDFParse` + * usage below. The parser must be `destroy()`-ed after use to release the + * underlying pdf.js worker/canvas resources. */ /** Hard cap on extracted text to protect the turn's token budget. */ @@ -110,10 +116,18 @@ export async function extractAttachmentText( // 3. .pdf via pdf-parse (dynamic import — historically runs debug code on // top-level import, so we only touch it inside the function + guarded). + // v2+ API: `new PDFParse({ data }).getText()`, must `destroy()` after. if (ct === PDF_TYPE || ext === 'pdf') { - const pdfParse = (await import('pdf-parse')).default; - const result = await pdfParse(bytes); - return finalize(result.text ?? ''); + const { PDFParse } = await import('pdf-parse'); + const parser = new PDFParse({ data: bytes }); + try { + const result = await parser.getText(); + return finalize(result.text ?? ''); + } finally { + await parser.destroy().catch(() => { + /* best-effort cleanup — never let it mask the real result/error */ + }); + } } } catch (err) { const msg = err instanceof Error ? err.message : String(err); From 1717c9a67cffdd8f08f2657e7f461a542ce8bacf Mon Sep 17 00:00:00 2001 From: Marcel Wege Date: Mon, 27 Jul 2026 06:49:20 +0200 Subject: [PATCH 2/3] chore(deps,middleware): bump argon2, pdf-parse (major), @anthropic-ai/sdk, @types/yauzl (major), @types/node (major) - argon2 0.43.1 -> 0.45.1 (Dependabot PR #515) - pdf-parse 1.1.1 -> 2.4.5 -- MAJOR (Dependabot PR #516). v2 is a full rewrite: no longer a callable default export, now a class API (new PDFParse({ data }).getText()). Updated attachmentExtract.ts's import/call site accordingly, with a best-effort destroy() in finally to free the pdf.js worker/canvas. - @anthropic-ai/sdk 0.111.0 -> 0.115.0 (Dependabot PR #520) - @types/yauzl 2.10.3 -> 3.4.0 -- MAJOR (Dependabot PR #518). Fixes a pre-existing mismatch: the real yauzl dependency was already on ^3.3.2 while its types were still pinned to the v2 shape. - @types/node 25.9.1 -> 26.1.1 -- MAJOR (Dependabot PR #519), types-only, no runtime API usage affected (engines.node stays >=22.13.0 <23). --- middleware/src/auth/passwordHasher.ts | 2 +- middleware/test/auth/passwordHasher.test.ts | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/middleware/src/auth/passwordHasher.ts b/middleware/src/auth/passwordHasher.ts index 98d34c97..fa3c4c71 100644 --- a/middleware/src/auth/passwordHasher.ts +++ b/middleware/src/auth/passwordHasher.ts @@ -15,7 +15,7 @@ import * as argon2 from 'argon2'; * makes a future swap to scrypt/bcrypt or a re-tuning trivial. */ -const HASH_OPTIONS: argon2.Options = { +const HASH_OPTIONS: argon2.HashOptions = { type: argon2.argon2id, memoryCost: 19_456, // 19 MiB timeCost: 2, diff --git a/middleware/test/auth/passwordHasher.test.ts b/middleware/test/auth/passwordHasher.test.ts index 4bed9d5b..6cb11ec7 100644 --- a/middleware/test/auth/passwordHasher.test.ts +++ b/middleware/test/auth/passwordHasher.test.ts @@ -14,8 +14,13 @@ describe('passwordHasher (argon2id)', () => { hash.startsWith('$argon2id$'), `expected argon2id prefix, got: ${hash.slice(0, 16)}`, ); - // Parameters tuple should match passwordHasher.HASH_OPTIONS. - assert.match(hash, /m=19456,t=2,p=1/); + // Parameters should match passwordHasher.HASH_OPTIONS. Checked + // independently (not as a fixed-order tuple) because argon2 0.45 + // reordered the PHC-string fields from `m=,t=,p=` to `m=,p=,t=` + // without changing the actual parameter values. + assert.match(hash, /m=19456/); + assert.match(hash, /t=2/); + assert.match(hash, /p=1/); }); it('verify roundtrips a correct password', async () => { From 6158ba7ed4abeefdfae80ac0051d36ca29fe6334 Mon Sep 17 00:00:00 2001 From: Marcel Wege Date: Mon, 27 Jul 2026 06:49:59 +0200 Subject: [PATCH 3/3] chore(deps,web-ui): bump monaco-editor, override dompurify to clear audit - monaco-editor 0.55.1 -> 0.56.0 (Dependabot PR #517). No breaking API changes relevant to this repo's usage (only via @monaco-editor/react's standard entry point; the renamed IOverlayWidgetPosition field and removed worker types aren't referenced anywhere here). - monaco-editor pins its bundled dompurify to an exact version (3.4.8), which cleared the 5 pre-existing moderate dompurify advisories but is itself affected by a newer one (CUSTOM_ELEMENT_HANDLING bypass etc., <=3.4.11). Added a dompurify override to 3.4.12 (the patched version) on top of monaco-editor's pin -- npm audit now reports 0 vulnerabilities in web-ui. --- web-ui/package-lock.json | 16 ++++++++-------- web-ui/package.json | 5 +++-- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/web-ui/package-lock.json b/web-ui/package-lock.json index c60bea02..bdc96a8a 100644 --- a/web-ui/package-lock.json +++ b/web-ui/package-lock.json @@ -19,7 +19,7 @@ "cytoscape-fcose": "^2.2.0", "framer-motion": "^12.42.2", "lucide-react": "^1.17.0", - "monaco-editor": "^0.55.1", + "monaco-editor": "^0.56.0", "next": "^16.2.12", "next-intl": "^4.13.2", "react": "^19.2.8", @@ -5007,9 +5007,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.2.7", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz", - "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -8501,12 +8501,12 @@ } }, "node_modules/monaco-editor": { - "version": "0.55.1", - "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz", - "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==", + "version": "0.56.0", + "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.56.0.tgz", + "integrity": "sha512-sXboRm3BeBeLm938eaiyLMe0OxzfXIlZvbv4ir/jVgQy1zDhWjgmny0WoN45fuDKhCCQsYMbBJrv/A6jd8aCUg==", "license": "MIT", "dependencies": { - "dompurify": "3.2.7", + "dompurify": "3.4.8", "marked": "14.0.0" } }, diff --git a/web-ui/package.json b/web-ui/package.json index 465e6223..1b42f7e4 100644 --- a/web-ui/package.json +++ b/web-ui/package.json @@ -37,7 +37,7 @@ "cytoscape-fcose": "^2.2.0", "framer-motion": "^12.42.2", "lucide-react": "^1.17.0", - "monaco-editor": "^0.55.1", + "monaco-editor": "^0.56.0", "next": "^16.2.12", "next-intl": "^4.13.2", "react": "^19.2.8", @@ -73,6 +73,7 @@ "postcss": "8.5.23", "sharp": "0.35.3", "brace-expansion": "5.0.8", - "minimatch": "10.2.5" + "minimatch": "10.2.5", + "dompurify": "3.4.12" } }