From 78c45f28bbb2270059230bec6a7d1b9b69c6aacb Mon Sep 17 00:00:00 2001 From: Gabriel Vieira Soriano Aderaldo Date: Mon, 5 Oct 2026 16:18:01 -0300 Subject: [PATCH] =?UTF-8?q?fix(deps):=20fastify=205.12.5,=20nodemailer=201?= =?UTF-8?q?0.0.14=20e=20os=20pisos=20de=20fast-uri=20e=20brace-expansion?= =?UTF-8?q?=20=E2=80=94=20o=20audit=20de=20produ=C3=A7=C3=A3o=20voltou=20a?= =?UTF-8?q?=20recusar=20a=20=C3=A1rvore?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O `audit (produção — blocking)` reprovou a PR da 1.0.0-rc.4 com 10 advisories high e 6 moderate em dependências de runtime, todas publicadas depois do último CI verde da dev (01/10). A produção atual (rc.3) carrega as mesmas versões. - fastify 5.12.1 → 5.12.5: GHSA-p68q-wchp-6fh7 (authentication bypass via URL malformada até o not-found encapsulado), GHSA-hwr6-493r-vm6h e GHSA-9q9j-q6p8-xq58 (bypass de validação de request e de header), GHSA-667r-xxjv-c9mm (troca de body por colisão de validação async) — high; GHSA-4mh8-r7rc-xpvc (DoS em trailer HTTP/2, moderate, fechado só na 5.12.5). - nodemailer 9.1.1 → 10.0.14: GHSA-prgh-xp8r-p3m5 e GHSA-v53p-9fqp-m79j (DoS quadrático no addressparser) — high; GHSA-g57g-f23g-4646, GHSA-6vj9-mwq6-2f5v, GHSA-8vvx-rff5-p5rq — moderate. A única quebra da major 10 é exigir Node ≥ 20 (o projeto é 24). A 10.0.15 saiu hoje e está na quarentena de `minimumReleaseAge`; a 10.0.14 é a mais nova madura. Substitui a #1023 (Dependabot, 10.0.9), que não fecha os advisories posteriores. - overrides: fast-uri `>=3.1.8 <4` e brace-expansion `>=5.0.12 <6`. A 5ª rodada do fast-uri acertou a própria 3.1.6 que era o piso — o aviso do pnpm-workspace.yaml se cumpriu de novo. `pnpm audit --prod`: No known vulnerabilities found. Gate verde: typecheck, format:check, lint e test — 11908 testes, 11884 pass, 0 falhas, 19 skipped, 5 todo (#388). Assisted-by: Claude-Code:claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 (1M context) --- package.json | 4 +-- pnpm-lock.yaml | 67 ++++++++++++++++++++------------------------- pnpm-workspace.yaml | 18 ++++++++++-- 3 files changed, 47 insertions(+), 42 deletions(-) diff --git a/package.json b/package.json index d41180f8..e8434348 100644 --- a/package.json +++ b/package.json @@ -116,12 +116,12 @@ "@fastify/swagger-ui": "5.2.6", "drizzle-orm": "0.45.2", "fast-xml-parser": "5.7.3", - "fastify": "5.12.1", + "fastify": "5.12.5", "fastify-zod-openapi": "5.6.1", "hash-wasm": "4.12.0", "jose": "6.2.3", "mysql2": "3.23.1", - "nodemailer": "9.1.1", + "nodemailer": "10.0.14", "resend": "6.12.4", "unpdf": "1.6.2", "zod": "4.4.3", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 56b0c0e6..5a62ccc6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,8 +6,8 @@ settings: overrides: esbuild: '>=0.25.0 <0.27.3 || >=0.28.1' - fast-uri: '>=3.1.6 <4' - brace-expansion: '>=5.0.9 <6' + fast-uri: '>=3.1.8 <4' + brace-expansion: '>=5.0.12 <6' find-my-way: ^9.7.0 '@fastify/static': ^10.1.2 @@ -43,11 +43,11 @@ importers: specifier: 5.7.3 version: 5.7.3 fastify: - specifier: 5.12.1 - version: 5.12.1 + specifier: 5.12.5 + version: 5.12.5 fastify-zod-openapi: specifier: 5.6.1 - version: 5.6.1(@fastify/swagger-ui@5.2.6)(@fastify/swagger@9.7.0(supports-color@7.2.0))(fastify@5.12.1)(zod@4.4.3) + version: 5.6.1(@fastify/swagger-ui@5.2.6)(@fastify/swagger@9.7.0(supports-color@7.2.0))(fastify@5.12.5)(zod@4.4.3) hash-wasm: specifier: 4.12.0 version: 4.12.0 @@ -58,8 +58,8 @@ importers: specifier: 3.23.1 version: 3.23.1(@types/node@24.13.3) nodemailer: - specifier: 9.1.1 - version: 9.1.1 + specifier: 10.0.14 + version: 10.0.14 resend: specifier: 6.12.4 version: 6.12.4 @@ -1113,8 +1113,8 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -1543,8 +1543,8 @@ packages: fast-sha256@1.3.0: resolution: {integrity: sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==} - fast-uri@3.1.6: - resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} @@ -1573,8 +1573,8 @@ packages: '@fastify/swagger-ui': optional: true - fastify@5.12.1: - resolution: {integrity: sha512-FWi+tQvwxR/PeRX7Z2mhfEF5ozJ3jn9asiiclzKXNSzJRHAYcU924aIOKAdHFJ+YIKieh3cqr1IwCOvTr41B3Q==} + fastify@5.12.5: + resolution: {integrity: sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -2158,9 +2158,9 @@ packages: version: 24.16.0 hasBin: true - nodemailer@9.1.1: - resolution: {integrity: sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==} - engines: {node: '>=6.0.0'} + nodemailer@10.0.14: + resolution: {integrity: sha512-eJoLFKg55fesSlzUekmfOv/SBXh4KUYT8oiQc2RLP0tfG0rbNMJBK7wgHJwXTJwqyKlSJMz9UzDZ4v+aHEvo8g==} + engines: {node: '>=20.0.0'} npm-run-path@4.0.1: resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==} @@ -2409,11 +2409,6 @@ packages: resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==} hasBin: true - semver@7.8.0: - resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==} - engines: {node: '>=10'} - hasBin: true - semver@7.8.5: resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==} engines: {node: '>=10'} @@ -3475,7 +3470,7 @@ snapshots: dependencies: ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) - fast-uri: 3.1.6 + fast-uri: 3.1.8 '@fastify/cors@11.2.0': dependencies: @@ -3788,7 +3783,7 @@ snapshots: '@typescript-eslint/visitor-keys': 8.59.3 debug: 4.4.3(supports-color@7.2.0) minimatch: 10.2.5 - semver: 7.8.0 + semver: 7.8.5 tinyglobby: 0.2.16 ts-api-utils: 2.5.0(typescript@6.0.3) typescript: 6.0.3 @@ -3997,7 +3992,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4069,7 +4064,7 @@ snapshots: bowser@2.14.1: {} - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -4457,7 +4452,7 @@ snapshots: '@fastify/merge-json-schemas': 0.2.1 ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) - fast-uri: 3.1.6 + fast-uri: 3.1.8 json-schema-ref-resolver: 3.0.0 rfdc: 1.4.1 @@ -4466,7 +4461,7 @@ snapshots: '@fastify/merge-json-schemas': 0.2.1 ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) - fast-uri: 3.1.6 + fast-uri: 3.1.8 json-schema-ref-resolver: 3.0.0 rfdc: 1.4.1 @@ -4478,7 +4473,7 @@ snapshots: fast-sha256@1.3.0: {} - fast-uri@3.1.6: {} + fast-uri@3.1.8: {} fast-xml-builder@1.2.0: dependencies: @@ -4496,11 +4491,11 @@ snapshots: fastify-plugin@6.0.0: {} - fastify-zod-openapi@5.6.1(@fastify/swagger-ui@5.2.6)(@fastify/swagger@9.7.0(supports-color@7.2.0))(fastify@5.12.1)(zod@4.4.3): + fastify-zod-openapi@5.6.1(@fastify/swagger-ui@5.2.6)(@fastify/swagger@9.7.0(supports-color@7.2.0))(fastify@5.12.5)(zod@4.4.3): dependencies: '@fastify/error': 4.2.0 fast-json-stringify: 6.4.0 - fastify: 5.12.1 + fastify: 5.12.5 fastify-plugin: 5.1.0 zod: 4.4.3 zod-openapi: 5.4.6(zod@4.4.3) @@ -4508,7 +4503,7 @@ snapshots: '@fastify/swagger': 9.7.0(supports-color@7.2.0) '@fastify/swagger-ui': 5.2.6 - fastify@5.12.1: + fastify@5.12.5: dependencies: '@fastify/ajv-compiler': 4.0.6 '@fastify/error': 4.2.0 @@ -4821,7 +4816,7 @@ snapshots: json-schema-resolver@3.0.0(supports-color@7.2.0): dependencies: debug: 4.4.3(supports-color@7.2.0) - fast-uri: 3.1.6 + fast-uri: 3.1.8 rfdc: 1.4.1 transitivePeerDependencies: - supports-color @@ -4851,7 +4846,7 @@ snapshots: lodash.isstring: 4.0.1 lodash.once: 4.1.1 ms: 2.1.3 - semver: 7.8.0 + semver: 7.8.5 jwa@2.0.1: dependencies: @@ -4952,7 +4947,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -4996,7 +4991,7 @@ snapshots: node@runtime:24.16.0: {} - nodemailer@9.1.1: {} + nodemailer@10.0.14: {} npm-run-path@4.0.1: dependencies: @@ -5219,8 +5214,6 @@ snapshots: semver@6.3.1: {} - semver@7.8.0: {} - semver@7.8.5: {} set-cookie-parser@2.7.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 9b714af3..595868ec 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -45,9 +45,21 @@ allowBuilds: # Piso subido para 3.1.6 — a MÍNIMA que fecha as quatro. A 3.1.7 existe e o fastify 5.12.1 já a # resolve, mas caiu na quarentena de `minimumReleaseAge` (publicada em 02/09 11:06 UTC); a faixa # `<4` deixa ela entrar sozinha assim que amadurecer, sem exigir novo override. +# - 5ª rodada (VIGENTE, medida pelo audit em 05/10/2026) — e o piso 3.1.6 virou ele mesmo o alvo: +# - GHSA-58mr-gqgx-xq4g: =3.1.6 — host confusion via colchete não fechado na authority (high) +# - GHSA-qw65-cvwx-89v3: >=3.0.0 <3.1.7 — authority injection via porta não validada no +# serialize (high) +# - GHSA-hrr3-gc8f-f4qj: >=3.0.0 <3.1.8 — normalização de caixa do host inconsistente via +# octetos percent-encoded (moderate) +# Piso subido para 3.1.8, a mínima que fecha as três. # - GHSA-3jxr-9vmj-r5cp: brace-expansion <5.0.7 — DoS por expansão exponencial (1ª/2ª rodada) # - GHSA-rgw5-rvv9-x895: brace-expansion <5.0.9 — DoS por arrays intermediários sem limite, -# contorna a mitigação do CVE-2026-14257. CVSS 7.5 (3ª, VIGENTE) +# contorna a mitigação do CVE-2026-14257. CVSS 7.5 (3ª) +# - 4ª rodada (VIGENTE, medida pelo audit em 05/10/2026), todas publicadas em 14/09/2026: +# - GHSA-6j4f-fj2g-mc7p: >=4.0.0 <5.0.10 — DoS por recursão sem limite em parseCommaParts (high) +# - GHSA-qhr7-859c-m2p7: >=4.0.0 <5.0.11 — DoS por recursão em grupos aninhados (high) +# - GHSA-q2hr-2g5m-vwhr: >=4.0.0 <5.0.12 — expansão quadrática do rewrite `{a},b}` (moderate) +# Piso subido para 5.0.12, a mínima que fecha as três. # Transitiva de runtime via @fastify/swagger-ui → @fastify/static → glob → minimatch. # Exposição real BAIXA: exige o atacante controlar o input do expand(); aqui o glob serve os # assets do /docs, com padrões internos. @@ -67,8 +79,8 @@ allowBuilds: # entre 9 e 10, validado por boot + fastify.inject do /docs (ver ticket #573). overrides: esbuild: '>=0.25.0 <0.27.3 || >=0.28.1' - fast-uri: '>=3.1.6 <4' - brace-expansion: '>=5.0.9 <6' + fast-uri: '>=3.1.8 <4' + brace-expansion: '>=5.0.12 <6' find-my-way: '^9.7.0' '@fastify/static': '^10.1.2'