From fc72bd0513e1d7a5aa9231966219fa8c0f2b3ac1 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 3 Sep 2026 23:59:38 -0400 Subject: [PATCH] fix(deps): clear high-severity Dependabot advisories (engine.io/socket.io-parser/brace-expansion/postcss/fast-uri/ws) Adds/tightens pnpm overrides at the workspace root for six packages, clearing 15 high-severity Dependabot alerts: - fast-uri: floor raised 3.1.2 -> 4.1.3 (resolved 4.1.2 -> 4.1.4; already a transitive-only dep with no direct import, safe patch-equivalent bump) - engine.io >=6.6.7 (was 6.6.6), socket.io-parser >=4.2.7 (was 4.2.6) - brace-expansion >=5.0.9 (was 5.0.5), postcss >=8.5.18 (8.5.23 instance already satisfied it, 8.5.8 instance did not) - ws: two range-scoped overrides so the 7.x line resolves to >=7.5.11 and the 8.x line to >=8.21.0 without forcing a 7->8 major bump Deliberately NOT touched: - @faker-js/faker (alert #173): Dependabot's own PR #96 already bumps 10.4.0 -> 10.5.0 directly; not duplicating that diff here. - linkify-it (alerts #124/#130): hard-pinned at 3.0.3 by ansi-to-react, fix needs 5.0.2 (two-major jump on a dependency with no test coverage here) -- left for manual review, logged in the P6 residue register. Ticket: P6 DEPENDABOT-HIGH-SWEEP unit (nself PPI phase P6) --- package.json | 10 +++- pnpm-lock.yaml | 143 +++++++++++++++++++++---------------------------- 2 files changed, 70 insertions(+), 83 deletions(-) diff --git a/package.json b/package.json index 879d2b87..d22440ed 100644 --- a/package.json +++ b/package.json @@ -79,9 +79,15 @@ "protobufjs": ">=7.2.4 <8.0.0", "lodash": ">=4.18.1", "@grpc/grpc-js": ">=1.14.4", - "fast-uri": ">=3.1.2", + "fast-uri": ">=4.1.3", "fast-xml-builder": ">=1.1.7", - "browserslist@<4.28.7": "^4.28.7" + "browserslist@<4.28.7": "^4.28.7", + "engine.io": ">=6.6.7", + "socket.io-parser": ">=4.2.7", + "brace-expansion": ">=5.0.9", + "postcss": ">=8.5.18", + "ws@<7.5.11": ">=7.5.11", + "ws@>=8.0.0": ">=8.21.0" } }, "dependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 11163e1b..9d6e17f2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -16,9 +16,15 @@ overrides: protobufjs: '>=7.2.4 <8.0.0' lodash: '>=4.18.1' '@grpc/grpc-js': '>=1.14.4' - fast-uri: '>=3.1.2' + fast-uri: '>=4.1.3' fast-xml-builder: '>=1.1.7' browserslist@<4.28.7: ^4.28.7 + engine.io: '>=6.6.7' + socket.io-parser: '>=4.2.7' + brace-expansion: '>=5.0.9' + postcss: '>=8.5.18' + ws@<7.5.11: '>=7.5.11' + ws@>=8.0.0: '>=8.21.0' importers: @@ -29,7 +35,7 @@ importers: version: 1.19.7(@algolia/client-search@5.36.0)(algoliasearch@5.36.0)(search-insights@2.17.3) '@faker-js/faker': specifier: ^10.4.0 - version: 10.4.0 + version: 10.6.0 '@headlessui/react': specifier: ^2.2.9 version: 2.2.9(react-dom@19.2.4(react@19.2.4))(react@19.2.4) @@ -736,8 +742,8 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@faker-js/faker@10.4.0': - resolution: {integrity: sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw==} + '@faker-js/faker@10.6.0': + resolution: {integrity: sha512-3RQHgEtvL1Frl/d1cSreo7qhJ3Gk1OdNUai/CtZ8G+wYeRQnJih3s9xJ9/kgYekPQRdwgh0HXRPqMlzWGwivIQ==} engines: {node: ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0, npm: '>=10'} '@fastify/otel@0.18.0': @@ -3216,9 +3222,9 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -3636,8 +3642,8 @@ packages: resolution: {integrity: sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==} engines: {node: '>=10.0.0'} - engine.io@6.6.6: - resolution: {integrity: sha512-U2SN0w3OpjFRVlrc17E6TMDmH58Xl9rai1MblNjAdwWp07Kk+llmzX0hjDpQdrDGzwmvOtgM5yI+meYX6iZ2xA==} + engine.io@6.6.10: + resolution: {integrity: sha512-9/lX2bdlizlCXMHRMOIm03VBQHQYC7VvydcxtTAUJRxNW1QzM/2PMFSmr6h/lCiMHcyCP6abK+t9Q+j4vekk8Q==} engines: {node: '>=10.2.0'} enhanced-resolve@5.20.1: @@ -3933,8 +3939,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@4.1.2: - resolution: {integrity: sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==} + fast-uri@4.1.4: + resolution: {integrity: sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} @@ -5375,10 +5381,6 @@ packages: resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} - postcss@8.5.8: - resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==} - engines: {node: ^10 || ^12 || >=14} - postgres-array@2.0.0: resolution: {integrity: sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==} engines: {node: '>=4'} @@ -5858,8 +5860,8 @@ packages: resolution: {integrity: sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==} engines: {node: '>=10.0.0'} - socket.io-parser@4.2.6: - resolution: {integrity: sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==} + socket.io-parser@4.2.7: + resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==} engines: {node: '>=10.0.0'} socket.io@4.8.3: @@ -6457,20 +6459,8 @@ packages: resolution: {integrity: sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==} engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0} - ws@7.5.10: - resolution: {integrity: sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==} - engines: {node: '>=8.3.0'} - peerDependencies: - bufferutil: ^4.0.1 - utf-8-validate: ^5.0.2 - peerDependenciesMeta: - bufferutil: - optional: true - utf-8-validate: - optional: true - - ws@8.18.3: - resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==} + ws@8.20.0: + resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -6481,8 +6471,8 @@ packages: utf-8-validate: optional: true - ws@8.20.0: - resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==} + ws@8.21.3: + resolution: {integrity: sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -7002,7 +6992,7 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@faker-js/faker@10.4.0': {} + '@faker-js/faker@10.6.0': {} '@fastify/otel@0.18.0(@opentelemetry/api@1.9.1)': dependencies: @@ -7223,7 +7213,7 @@ snapshots: '@jest/console@30.3.0': dependencies: '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 jest-message-util: 30.3.0 jest-util: 30.3.0 @@ -7299,7 +7289,7 @@ snapshots: dependencies: '@jest/types': 30.3.0 '@sinonjs/fake-timers': 15.1.1 - '@types/node': 24.12.0 + '@types/node': 24.13.3 jest-message-util: 30.3.0 jest-mock: 30.3.0 jest-util: 30.3.0 @@ -7317,7 +7307,7 @@ snapshots: '@jest/pattern@30.0.1': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 jest-regex-util: 30.0.1 '@jest/reporters@30.3.0': @@ -7328,7 +7318,7 @@ snapshots: '@jest/transform': 30.3.0 '@jest/types': 30.3.0 '@jridgewell/trace-mapping': 0.3.31 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 collect-v8-coverage: 1.0.3 exit-x: 0.2.2 @@ -8805,7 +8795,7 @@ snapshots: '@alloc/quick-lru': 5.2.0 '@tailwindcss/node': 4.2.2 '@tailwindcss/oxide': 4.2.2 - postcss: 8.5.8 + postcss: 8.5.23 tailwindcss: 4.2.2 '@tailwindcss/typography@0.5.19(tailwindcss@4.2.2)': @@ -8895,11 +8885,11 @@ snapshots: '@types/connect@3.4.38': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/cors@2.8.19': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/d3-array@3.2.2': {} @@ -8985,7 +8975,7 @@ snapshots: '@types/jsdom@21.1.7': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/tough-cookie': 4.0.5 parse5: 7.3.0 @@ -9007,7 +8997,7 @@ snapshots: '@types/mysql@2.15.27': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/node@18.19.130': dependencies: @@ -9027,7 +9017,7 @@ snapshots: '@types/pg@8.15.6': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 pg-protocol: 1.13.0 pg-types: 2.2.0 @@ -9061,7 +9051,7 @@ snapshots: '@types/tedious@4.0.14': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/tough-cookie@4.0.5': {} @@ -9078,7 +9068,7 @@ snapshots: '@types/ws@8.18.1': dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/yargs-parser@21.0.3': {} @@ -9378,7 +9368,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 4.1.2 + fast-uri: 4.1.4 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -9617,7 +9607,7 @@ snapshots: boolbase@1.0.0: {} - brace-expansion@5.0.5: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -9771,7 +9761,7 @@ snapshots: dom-serializer: 2.0.0 domhandler: 5.0.3 htmlparser2: 8.0.2 - postcss: 8.5.8 + postcss: 8.5.23 postcss-media-query-parser: 0.2.3 cross-spawn@7.0.6: @@ -10006,7 +9996,7 @@ snapshots: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 engine.io-parser: 5.2.3 - ws: 8.18.3 + ws: 8.21.3 xmlhttprequest-ssl: 2.1.2 transitivePeerDependencies: - bufferutil @@ -10015,18 +10005,17 @@ snapshots: engine.io-parser@5.2.3: {} - engine.io@6.6.6: + engine.io@6.6.10: dependencies: '@types/cors': 2.8.19 - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@types/ws': 8.18.1 accepts: 1.3.8 - base64id: 2.0.0 cookie: 0.7.2 cors: 2.8.6 debug: 4.4.3 engine.io-parser: 5.2.3 - ws: 8.18.3 + ws: 8.21.3 transitivePeerDependencies: - bufferutil - supports-color @@ -10495,7 +10484,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@4.1.2: {} + fast-uri@4.1.4: {} fast-xml-builder@1.2.0: dependencies: @@ -11075,7 +11064,7 @@ snapshots: '@jest/expect': 30.3.0 '@jest/test-result': 30.3.0 '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 co: 4.6.0 dedent: 1.7.2 @@ -11179,7 +11168,7 @@ snapshots: '@jest/environment': 30.3.0 '@jest/fake-timers': 30.3.0 '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 jest-mock: 30.3.0 jest-util: 30.3.0 jest-validate: 30.3.0 @@ -11187,7 +11176,7 @@ snapshots: jest-haste-map@30.3.0: dependencies: '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 anymatch: 3.1.3 fb-watchman: 2.0.2 graceful-fs: 4.2.11 @@ -11260,7 +11249,7 @@ snapshots: '@jest/test-result': 30.3.0 '@jest/transform': 30.3.0 '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 emittery: 0.13.1 exit-x: 0.2.2 @@ -11289,7 +11278,7 @@ snapshots: '@jest/test-result': 30.3.0 '@jest/transform': 30.3.0 '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 cjs-module-lexer: 2.2.0 collect-v8-coverage: 1.0.3 @@ -11336,7 +11325,7 @@ snapshots: jest-util@30.3.0: dependencies: '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 chalk: 4.1.2 ci-info: 4.4.0 graceful-fs: 4.2.11 @@ -11355,7 +11344,7 @@ snapshots: dependencies: '@jest/test-result': 30.3.0 '@jest/types': 30.3.0 - '@types/node': 24.12.0 + '@types/node': 24.13.3 ansi-escapes: 4.3.2 chalk: 4.1.2 emittery: 0.13.1 @@ -11370,7 +11359,7 @@ snapshots: jest-worker@30.3.0: dependencies: - '@types/node': 24.12.0 + '@types/node': 24.13.3 '@ungap/structured-clone': 1.3.0 jest-util: 30.3.0 merge-stream: 2.0.0 @@ -11428,7 +11417,7 @@ snapshots: whatwg-encoding: 3.1.1 whatwg-mimetype: 4.0.0 whatwg-url: 14.2.0 - ws: 8.20.0 + ws: 8.21.3 xml-name-validator: 5.0.0 transitivePeerDependencies: - bufferutil @@ -12058,7 +12047,7 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.9 minimist@1.2.8: {} @@ -12411,12 +12400,6 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 - postcss@8.5.8: - dependencies: - nanoid: 3.3.18 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postgres-array@2.0.0: {} postgres-bytea@1.0.1: {} @@ -12982,7 +12965,7 @@ snapshots: socket.io-adapter@2.5.6: dependencies: debug: 4.4.3 - ws: 8.18.3 + ws: 8.21.3 transitivePeerDependencies: - bufferutil - supports-color @@ -12993,13 +12976,13 @@ snapshots: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 engine.io-client: 6.6.4 - socket.io-parser: 4.2.6 + socket.io-parser: 4.2.7 transitivePeerDependencies: - bufferutil - supports-color - utf-8-validate - socket.io-parser@4.2.6: + socket.io-parser@4.2.7: dependencies: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 @@ -13012,9 +12995,9 @@ snapshots: base64id: 2.0.0 cors: 2.8.6 debug: 4.4.3 - engine.io: 6.6.6 + engine.io: 6.6.10 socket.io-adapter: 2.5.6 - socket.io-parser: 4.2.6 + socket.io-parser: 4.2.7 transitivePeerDependencies: - bufferutil - supports-color @@ -13584,7 +13567,7 @@ snapshots: opener: 1.5.2 picocolors: 1.1.1 sirv: 2.0.4 - ws: 7.5.10 + ws: 8.20.0 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -13721,12 +13704,10 @@ snapshots: imurmurhash: 0.1.4 signal-exit: 4.1.0 - ws@7.5.10: {} - - ws@8.18.3: {} - ws@8.20.0: {} + ws@8.21.3: {} + xml-name-validator@5.0.0: {} xml-naming@0.1.0: {}