From e02e0de38445229b6281e7ae9ff56f557b39d29a Mon Sep 17 00:00:00 2001 From: nicktrn <55853254+nicktrn@users.noreply.github.com> Date: Mon, 27 Apr 2026 15:09:21 +0100 Subject: [PATCH] chore(security): bump existing overrides + dompurify direct dep --- apps/webapp/package.json | 2 +- package.json | 8 ++-- pnpm-lock.yaml | 94 ++++++++++++++++++++++------------------ 3 files changed, 57 insertions(+), 47 deletions(-) diff --git a/apps/webapp/package.json b/apps/webapp/package.json index 007c9f393..af1d75d68 100644 --- a/apps/webapp/package.json +++ b/apps/webapp/package.json @@ -147,7 +147,7 @@ "cross-env": "^7.0.3", "cuid": "^2.1.8", "date-fns": "^4.1.0", - "dompurify": "^3.2.6", + "dompurify": "^3.4.1", "dotenv": "^16.4.5", "effect": "^3.11.7", "emails": "workspace:*", diff --git a/package.json b/package.json index c9b8d74f9..974c0f28a 100644 --- a/package.json +++ b/package.json @@ -93,13 +93,15 @@ "form-data@^2": "2.5.4", "form-data@^3": "3.0.4", "form-data@^4": "4.0.4", - "axios@1.9.0": ">=1.12.0", + "axios@>=1.0.0 <1.15.0": "^1.15.0", "js-yaml@>=3.0.0 <3.14.2": "3.14.2", "js-yaml@>=4.0.0 <4.1.1": "4.1.1", "jws@<3.2.3": "3.2.3", "qs@>=6.0.0 <6.14.1": "6.14.1", - "systeminformation@>=5.0.0 <5.27.14": "5.27.14", - "lodash@>=4.0.0 <4.17.23": "4.17.23", + "systeminformation@>=5.0.0 <5.31.0": "^5.31.0", + "lodash@>=4.0.0 <4.18.0": "^4.18.0", + "lodash-es@>=4.0.0 <4.18.0": "^4.18.0", + "dompurify@<3.4.0": "^3.4.1", "vite@>=5.0.0 <6.4.2": "^6.4.2", "rollup@>=4 <4.59.0": "^4.59.0", "flatted@<3.4.2": "^3.4.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4d4944a51..6004018dd 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,13 +13,15 @@ overrides: form-data@^2: 2.5.4 form-data@^3: 3.0.4 form-data@^4: 4.0.4 - axios@1.9.0: '>=1.12.0' + axios@>=1.0.0 <1.15.0: ^1.15.0 js-yaml@>=3.0.0 <3.14.2: 3.14.2 js-yaml@>=4.0.0 <4.1.1: 4.1.1 jws@<3.2.3: 3.2.3 qs@>=6.0.0 <6.14.1: 6.14.1 - systeminformation@>=5.0.0 <5.27.14: 5.27.14 - lodash@>=4.0.0 <4.17.23: 4.17.23 + systeminformation@>=5.0.0 <5.31.0: ^5.31.0 + lodash@>=4.0.0 <4.18.0: ^4.18.0 + lodash-es@>=4.0.0 <4.18.0: ^4.18.0 + dompurify@<3.4.0: ^3.4.1 vite@>=5.0.0 <6.4.2: ^6.4.2 rollup@>=4 <4.59.0: ^4.59.0 flatted@<3.4.2: ^3.4.2 @@ -590,8 +592,8 @@ importers: specifier: ^4.1.0 version: 4.1.0 dompurify: - specifier: ^3.2.6 - version: 3.2.6 + specifier: ^3.4.1 + version: 3.4.1 dotenv: specifier: ^16.4.5 version: 16.4.5 @@ -11667,8 +11669,8 @@ packages: resolution: {integrity: sha512-b1WlTV8+XKLj9gZy2DZXgQiyDp9xkkoe2a6U6UbYccScq2wgH/YwCeI2/Jq2mgo0HzQxqJOjWZBLeA/mqsk5Mg==} engines: {node: '>=4'} - axios@1.12.2: - resolution: {integrity: sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==} + axios@1.15.1: + resolution: {integrity: sha512-WOG+Jj8ZOvR0a3rAn+Tuf1UQJRxw5venr6DgdbJzngJE3qG7X0kL83CZGpdHMxEm+ZK3seAbvFsw4FfOfP9vxg==} axobject-query@3.2.1: resolution: {integrity: sha512-jsyHu61e6N4Vbz/v18DHwWYKK0bSWLqn47eeDSKPB7m8tqMHF9YJ+mhIk2lVteyZrY8tnSj/jHOv4YiTCuCJgg==} @@ -12984,8 +12986,8 @@ packages: resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==} engines: {node: '>= 4'} - dompurify@3.2.6: - resolution: {integrity: sha512-/2GogDQlohXPZe6D6NOgQvXLPSYBqIWMnZ8zzOhn09REE4eyAzb+Hed3jhoM9OkuaJ8P6ZGTTVWQKAi8ieIzfQ==} + dompurify@3.4.1: + resolution: {integrity: sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==} domutils@3.0.1: resolution: {integrity: sha512-z08c1l761iKhDFtfXO04C7kTdPBLi41zwOZl00WS8b5eiaebNpY00HKbztwBq+e3vyqWNwWF3mP9YLUeqIrF+Q==} @@ -13921,8 +13923,8 @@ packages: flatted@3.4.2: resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==} - follow-redirects@1.15.9: - resolution: {integrity: sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==} + follow-redirects@1.16.0: + resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -15308,8 +15310,8 @@ packages: resolution: {integrity: sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} - lodash-es@4.17.21: - resolution: {integrity: sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==} + lodash-es@4.18.1: + resolution: {integrity: sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==} lodash.camelcase@4.3.0: resolution: {integrity: sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==} @@ -15381,8 +15383,8 @@ packages: lodash.uniq@4.5.0: resolution: {integrity: sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==} - lodash@4.17.23: - resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==} + lodash@4.18.1: + resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} log-symbols@4.1.0: resolution: {integrity: sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==} @@ -17428,6 +17430,10 @@ packages: proxy-from-env@1.1.0: resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==} + proxy-from-env@2.1.0: + resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==} + engines: {node: '>=10'} + pseudomap@1.0.2: resolution: {integrity: sha512-b/YwNhb8lk1Zz2+bXXpS/LK9OisiZZ1SNsSLxN1x2OXVEhW2Ckr/7mWE5vrC1ZTiJlD9g19jWszTmJsB+oEpFQ==} @@ -18795,8 +18801,8 @@ packages: resolution: {integrity: sha512-L1dapNV6vu2s/4Sputv8xGsCdAVlb5nRDMFU/E27D44l5U6cw1g0dGd45uLc+OXjNMmF4ntiMdCimzcjFKQI8Q==} engines: {node: ^14.18.0 || >=16.0.0} - systeminformation@5.27.14: - resolution: {integrity: sha512-3DoNDYSZBLxBwaJtQGWNpq0fonga/VZ47HY1+7/G3YoIPaPz93Df6egSzzTKbEMmlzUpy3eQ0nR9REuYIycXGg==} + systeminformation@5.31.5: + resolution: {integrity: sha512-5SyLdip4/3alxD4Kh+63bUQTJmu7YMfYQTC+koZy7X73HgNqZSD2P4wOZQWtUncvPvcEmnfIjCoygN4MRoEejQ==} engines: {node: '>=8.0.0'} os: [darwin, linux, win32, freebsd, openbsd, netbsd, sunos, android] hasBin: true @@ -22824,12 +22830,12 @@ snapshots: dependencies: '@chevrotain/gast': 11.0.3 '@chevrotain/types': 11.0.3 - lodash-es: 4.17.21 + lodash-es: 4.18.1 '@chevrotain/gast@11.0.3': dependencies: '@chevrotain/types': 11.0.3 - lodash-es: 4.17.21 + lodash-es: 4.18.1 '@chevrotain/regexp-to-ast@11.0.3': {} @@ -24804,7 +24810,7 @@ snapshots: '@opentelemetry/host-metrics@0.37.0(@opentelemetry/api@1.9.0)': dependencies: '@opentelemetry/api': 1.9.0 - systeminformation: 5.27.14 + systeminformation: 5.31.5 '@opentelemetry/instrumentation-amqplib@0.46.1(@opentelemetry/api@1.9.0)': dependencies: @@ -28959,7 +28965,7 @@ snapshots: gunzip-maybe: 1.4.2 jsesc: 3.0.2 json5: 2.2.3 - lodash: 4.17.23 + lodash: 4.18.1 lodash.debounce: 4.0.8 minimatch: 9.0.5 ora: 5.4.1 @@ -29455,7 +29461,7 @@ snapshots: '@slack/types': 2.14.0 '@types/node': 20.14.14 '@types/retry': 0.12.0 - axios: 1.12.2 + axios: 1.15.1 eventemitter3: 5.0.1 form-data: 4.0.4 is-electron: 2.2.2 @@ -30672,7 +30678,7 @@ snapshots: chalk: 3.0.0 css.escape: 1.5.1 dom-accessibility-api: 0.6.3 - lodash: 4.17.23 + lodash: 4.18.1 redent: 3.0.0 '@tokenizer/token@0.3.0': {} @@ -30887,7 +30893,7 @@ snapshots: '@types/dompurify@3.2.0': dependencies: - dompurify: 3.2.6 + dompurify: 3.4.1 '@types/eslint-scope@3.7.4': dependencies: @@ -31449,7 +31455,7 @@ snapshots: eval: 0.1.6 find-up: 5.0.0 javascript-stringify: 2.1.0 - lodash: 4.17.23 + lodash: 4.18.1 mlly: 1.7.4 outdent: 0.8.0 vite: 4.4.9(@types/node@20.14.14)(lightningcss@1.29.2)(terser@5.46.1) @@ -32000,7 +32006,7 @@ snapshots: graceful-fs: 4.2.11 is-stream: 2.0.1 lazystream: 1.0.1 - lodash: 4.17.23 + lodash: 4.18.1 normalize-path: 3.0.0 readable-stream: 4.7.0 @@ -32204,11 +32210,11 @@ snapshots: axe-core@4.6.2: {} - axios@1.12.2: + axios@1.15.1: dependencies: - follow-redirects: 1.15.9 + follow-redirects: 1.16.0 form-data: 4.0.4 - proxy-from-env: 1.1.0 + proxy-from-env: 2.1.0 transitivePeerDependencies: - debug @@ -32629,7 +32635,7 @@ snapshots: chevrotain-allstar@0.3.1(chevrotain@11.0.3): dependencies: chevrotain: 11.0.3 - lodash-es: 4.17.21 + lodash-es: 4.18.1 chevrotain@11.0.3: dependencies: @@ -32638,7 +32644,7 @@ snapshots: '@chevrotain/regexp-to-ast': 11.0.3 '@chevrotain/types': 11.0.3 '@chevrotain/utils': 11.0.3 - lodash-es: 4.17.21 + lodash-es: 4.18.1 chokidar@3.5.3: dependencies: @@ -33290,7 +33296,7 @@ snapshots: dagre-d3-es@7.0.11: dependencies: d3: 7.9.0 - lodash-es: 4.17.21 + lodash-es: 4.18.1 damerau-levenshtein@1.0.8: {} @@ -33560,7 +33566,7 @@ snapshots: dependencies: domelementtype: 2.3.0 - dompurify@3.2.6: + dompurify@3.4.1: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -34914,7 +34920,7 @@ snapshots: flatted@3.4.2: {} - follow-redirects@1.15.9: {} + follow-redirects@1.16.0: {} for-each@0.3.3: dependencies: @@ -36367,7 +36373,7 @@ snapshots: dependencies: p-locate: 6.0.0 - lodash-es@4.17.21: {} + lodash-es@4.18.1: {} lodash.camelcase@4.3.0: {} @@ -36415,7 +36421,7 @@ snapshots: lodash.uniq@4.5.0: {} - lodash@4.17.23: {} + lodash@4.18.1: {} log-symbols@4.1.0: dependencies: @@ -36867,10 +36873,10 @@ snapshots: d3-sankey: 0.12.3 dagre-d3-es: 7.0.11 dayjs: 1.11.18 - dompurify: 3.2.6 + dompurify: 3.4.1 katex: 0.16.25 khroma: 2.1.0 - lodash-es: 4.17.21 + lodash-es: 4.18.1 marked: 16.4.1 roughjs: 4.6.6 stylis: 4.3.6 @@ -37700,7 +37706,7 @@ snapshots: node-emoji@1.11.0: dependencies: - lodash: 4.17.23 + lodash: 4.18.1 node-emoji@2.1.3: dependencies: @@ -38718,7 +38724,7 @@ snapshots: posthog-node@4.17.1: dependencies: - axios: 1.12.2 + axios: 1.15.1 transitivePeerDependencies: - debug @@ -38922,6 +38928,8 @@ snapshots: proxy-from-env@1.1.0: {} + proxy-from-env@2.1.0: {} + pseudomap@1.0.2: {} psl@1.9.0: {} @@ -39601,7 +39609,7 @@ snapshots: dependencies: clsx: 2.1.1 eventemitter3: 4.0.7 - lodash: 4.17.23 + lodash: 4.18.1 react: 18.2.0 react-dom: 18.2.0(react@18.2.0) react-is: 18.3.1 @@ -40955,7 +40963,7 @@ snapshots: '@pkgr/utils': 2.3.1 tslib: 2.8.1 - systeminformation@5.27.14: {} + systeminformation@5.31.5: {} table@6.9.0: dependencies: @@ -41008,7 +41016,7 @@ snapshots: detective: 5.2.1 fs-extra: 8.1.0 html-tags: 3.3.1 - lodash: 4.17.23 + lodash: 4.18.1 node-emoji: 1.11.0 normalize.css: 8.0.1 object-hash: 2.2.0