diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 95bd8a36..386427a3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,14 +10,17 @@ overrides: esbuild@<0.28.1: ^0.28.1 form-data@<2.5.6: ^2.5.6 form-data@>=4.0.0 <4.0.6: ^4.0.6 - undici: ^7.28.0 + undici: ^7.29.0 uuid: ^14.0.1 protobufjs: ^8.6.6 websocket-driver: ^0.7.5 axios@<1.18.0: '>=1.18.0' body-parser@<1.20.6: ^1.20.6 - brace-expansion@>=3.0.0 <5.0.7: '>=5.0.7' - fast-uri@>=3.0.0 <=3.1.3: ^3.1.4 + brace-expansion@>=2.0.0 <2.1.4: ^2.1.4 + brace-expansion@>=3.0.0 <5.0.9: '>=5.0.9' + fast-uri@>=3.0.0 <3.1.5: ^3.1.5 + nanoid@<3.3.18: ^3.3.18 + postcss@<8.5.18: ^8.5.18 sharp@<0.35.0: '>=0.35.0' shell-quote@<1.8.5: '>=1.8.5' @@ -3344,12 +3347,12 @@ packages: resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} browserslist@4.28.2: resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} @@ -3778,8 +3781,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} @@ -4541,8 +4544,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -4677,8 +4680,8 @@ packages: resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==} engines: {node: '>= 0.4'} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.26: + resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -5259,8 +5262,8 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -8432,7 +8435,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -8573,11 +8576,11 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@2.1.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.7: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -9114,7 +9117,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-xml-builder@1.2.0: dependencies: @@ -9735,7 +9738,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -9957,11 +9960,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.9 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.2 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -9971,7 +9974,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.12: {} + nanoid@3.3.18: {} natural-compare@1.4.0: {} @@ -10125,9 +10128,9 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss@8.5.15: + postcss@8.5.26: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -10843,7 +10846,7 @@ snapshots: undici-types@7.24.6: {} - undici@7.28.0: {} + undici@7.29.0: {} unicode-canonical-property-names-ecmascript@2.0.1: {} @@ -10937,7 +10940,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.26 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fdef26a1..54443813 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -23,11 +23,12 @@ overrides: "form-data@<2.5.6": "^2.5.6" "form-data@>=4.0.0 <4.0.6": "^4.0.6" # Patch undici advisories (GHSA-vmh5-mc38-953g / -vxpw-j846-p89q / -hm92-r4w5-c3mj - # / -35p6-xmwp-9g52 / -g8m3-5g58-fq7m, all <7.28.0). Transitive via jsdom + # / -35p6-xmwp-9g52 / -g8m3-5g58-fq7m / the <7.29.0 follow-up). Transitive via jsdom # (vitest/backstage/spotlight) — dev/test only, never shipped. Stay in major 7: # jsdom@29 require()s undici-7 internals (jsdom-dispatcher) that v8 removed, so - # forcing v8 breaks the vitest jsdom env. 7.28.0 fully patches every advisory above. - "undici": "^7.28.0" + # forcing v8 breaks the vitest jsdom env. 7.29.0 patches every advisory above and is + # the latest 7.x — the floor moves, the major does not. + "undici": "^7.29.0" # Patch uuid GHSA-w5hq-g745-h8pq (<11.1.1: missing buffer bounds check). Transitive # via firebase-admin>...>gaxios, which only uses v4() (random, no buf). Forced to the # latest major over the v8/v9 copies; v4 API is stable across these majors. @@ -49,13 +50,31 @@ overrides: # silently disables size enforcement). Transitive via firebase-functions>express@4 # (apps/beacon); express 4 requires body-parser ~1.20.x, so stay in the 1.x line. "body-parser@<1.20.6": "^1.20.6" - # Patch brace-expansion GHSA (>=3.0.0 <5.0.7: ReDoS). Only the v5 copy (via - # minimatch@10, which requires ^5.0.5) is vulnerable; scope the selector to the - # vulnerable 3.x/4.x/5.x range so the untouched v2 copy (minimatch@5) keeps v2. - "brace-expansion@>=3.0.0 <5.0.7": ">=5.0.7" - # Patch fast-uri GHSA (>=3.0.0 <=3.1.3). Transitive via ajv (workbox-build, dev), - # which requires fast-uri ^3.0.1 — stay in the 3.x line (3.1.4 is patched). - "fast-uri@>=3.0.0 <=3.1.3": "^3.1.4" + # Patch brace-expansion ReDoS, now flagged on BOTH copies in the tree, each with its + # own vulnerable range, so each needs its own selector inside its own major: + # v5 line (minimatch@10 requires ^5.0.5, via eslint>@eslint/config-array) — the + # advisory has been widened twice since the first override (<5.0.7, then <5.0.8, + # now <5.0.9); 5.0.9 is both the patch and the latest 5.x. + # v2 line (minimatch@5, via workbox-build>...>ejs>jake>filelist) — was untouched + # when the first override was written and is now in range (<2.1.4). minimatch@5 + # requires ^2.0.1, so 2.1.4 stays inside its consumer's range. + # Both are dev/build tooling only, never shipped. + "brace-expansion@>=2.0.0 <2.1.4": "^2.1.4" + "brace-expansion@>=3.0.0 <5.0.9": ">=5.0.9" + # Patch fast-uri GHSA (>=3.0.0 <3.1.5 — widened from the <=3.1.3 this override was + # first written for). Transitive via ajv (workbox-build, dev), which requires + # fast-uri ^3.0.1 — stay in the 3.x line (latest 4.x would break that range). + "fast-uri@>=3.0.0 <3.1.5": "^3.1.5" + # Patch nanoid GHSA-2v37-7h3g-55p8 and its predecessor (<3.3.18). Transitive via + # postcss (vite/vitest/@tailwindcss/vite, dev). postcss requires nanoid ^3.3.x, so + # the fix stays in the 3.x line; the selector's upper bound keeps any 5.x/6.x copy + # out of scope. + "nanoid@<3.3.18": "^3.3.18" + # Patch postcss GHSA-r28c-9q8g-f849 (<=8.5.17: path traversal via sourceMappingURL + # auto-loading, arbitrary .map disclosure). Transitive via vite (dev/build only — + # the traversal needs an attacker-authored stylesheet, which this repo does not + # process). 8.5.18 patches it; 8.5.26 is the latest 8.x. + "postcss@<8.5.18": "^8.5.18" # Patch sharp <0.35.0 (native libvips advisory). Transitive via # @vite-pwa/assets-generator (backstage icon regen, dev). >=0.35.0 patched; sharp # must stay listed under allowBuilds below (native postinstall or CI hard-fails).