diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e4c2f745..cc8ab990 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -164,6 +164,13 @@ settings: overrides: chokidar: 4.0.1 + proxy-addr: 2.0.8 + undici@>=7.0.0 <8.0.0: 7.30.0 + minimatch@>=10.0.0 <11.0.0: 10.2.6 + brace-expansion@>=1.0.0 <2.0.0: 1.1.21 + brace-expansion@>=2.0.0 <3.0.0: 2.1.7 + brace-expansion@>=3.0.0 <4.0.0: 3.0.9 + brace-expansion@>=5.0.0 <6.0.0: 5.0.12 importers: @@ -2137,10 +2144,6 @@ packages: blake3-wasm@2.1.5: resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==} - body-parser@2.2.2: - resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==} - engines: {node: '>=18'} - body-parser@2.3.0: resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} @@ -2149,12 +2152,12 @@ packages: resolution: {integrity: sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw==} engines: {node: '>=18'} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@5.0.3: - resolution: {integrity: sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -3218,8 +3221,8 @@ packages: resolution: {integrity: sha512-m/M3rpLnaouw6QSoKzylfw6Z1dnOwRM48idnZ7kc5ivRqBXANFQ8XqKCyQ/V+xqQ9Rg1L99j4WkZGVU9uT4L2w==} engines: {node: '>=22.0.0'} - minimatch@10.2.2: - resolution: {integrity: sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==} + minimatch@10.2.6: + resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} minimatch@3.1.5: @@ -3444,8 +3447,8 @@ packages: proto-list@1.2.4: resolution: {integrity: sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} publint@0.3.24: @@ -3509,10 +3512,6 @@ packages: resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==} engines: {node: '>=0.6'} - qs@6.14.1: - resolution: {integrity: sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==} - engines: {node: '>=0.6'} - qs@6.15.3: resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} engines: {node: '>=0.6'} @@ -4027,8 +4026,8 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} undici@8.11.2: @@ -4324,7 +4323,7 @@ snapshots: '@standard-schema/spec': 1.1.0 '@workflow/serde': 4.1.0 eventsource-parser: 3.0.8 - undici: 7.29.0 + undici: 7.30.0 zod: 4.6.5 '@ai-sdk/provider@4.0.19': @@ -4425,7 +4424,7 @@ snapshots: cacheable: 2.5.0 hookified: 1.15.1 http-cache-semantics: 4.2.0 - undici: 7.29.0 + undici: 7.30.0 '@cacheable/utils@2.5.0': dependencies: @@ -5423,20 +5422,6 @@ snapshots: blake3-wasm@2.1.5: {} - body-parser@2.2.2(supports-color@10.2.2): - dependencies: - bytes: 3.1.2 - content-type: 1.0.5 - debug: 4.4.3(supports-color@10.2.2) - http-errors: 2.0.1 - iconv-lite: 0.7.0 - on-finished: 2.4.1 - qs: 6.14.1 - raw-body: 3.0.2 - type-is: 2.0.1 - transitivePeerDependencies: - - supports-color - body-parser@2.3.0(supports-color@10.2.2): dependencies: bytes: 3.1.2 @@ -5462,12 +5447,12 @@ snapshots: widest-line: 5.0.0 wrap-ansi: 9.0.2 - brace-expansion@1.1.12: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.3: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -5876,7 +5861,7 @@ snapshots: express@5.2.1(supports-color@10.2.2): dependencies: accepts: 2.0.0 - body-parser: 2.2.2(supports-color@10.2.2) + body-parser: 2.3.0(supports-color@10.2.2) content-disposition: 1.0.0 content-type: 1.0.5 cookie: 0.7.1 @@ -5894,7 +5879,7 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.14.0 range-parser: 1.2.1 router: 2.2.0(supports-color@10.2.2) @@ -5989,7 +5974,7 @@ snapshots: glob@13.0.6: dependencies: - minimatch: 10.2.2 + minimatch: 10.2.6 minipass: 7.1.3 path-scurry: 2.0.2 @@ -6883,7 +6868,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.4(@types/node@24.19.0) - undici: 7.29.0 + undici: 7.30.0 workerd: 1.20260926.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -6892,13 +6877,13 @@ snapshots: - bufferutil - utf-8-validate - minimatch@10.2.2: + minimatch@10.2.6: dependencies: - brace-expansion: 5.0.3 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.12 + brace-expansion: 1.1.21 minimist@1.2.8: {} @@ -7088,7 +7073,7 @@ snapshots: proto-list@1.2.4: {} - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -7185,10 +7170,6 @@ snapshots: dependencies: side-channel: 1.1.0 - qs@6.14.1: - dependencies: - side-channel: 1.1.0 - qs@6.15.3: dependencies: es-define-property: 1.0.1 @@ -7853,7 +7834,7 @@ snapshots: undici-types@7.24.6: {} - undici@7.29.0: {} + undici@7.30.0: {} undici@8.11.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5b641933..252b3563 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -18,5 +18,17 @@ allowBuilds: unrs-resolver: true workerd: true # Pin transitive deps that later published without provenance (trust downgrade). +# These pins select patched releases for transitive security advisories. overrides: chokidar: 4.0.1 + # CVE-2026-90711. express accepts proxy-addr ^2.0.7. + proxy-addr: 2.0.8 + # CVE-2026-19534 and CVE-2026-84961. Direct undici 8.11.2 includes the 8.x fix. + "undici@>=7.0.0 <8.0.0": 7.30.0 + # CVE-2026-27903 and CVE-2026-27904. minimatch 3.1.5 includes the 3.x fix. + "minimatch@>=10.0.0 <11.0.0": 10.2.6 + # CVE-2026-102276, CVE-2026-102278, and the other brace-expansion DoS fixes. + "brace-expansion@>=1.0.0 <2.0.0": 1.1.21 + "brace-expansion@>=2.0.0 <3.0.0": 2.1.7 + "brace-expansion@>=3.0.0 <4.0.0": 3.0.9 + "brace-expansion@>=5.0.0 <6.0.0": 5.0.12