fix(deps): patch axios DoS and transitive prototype pollution/decompression vulns
Bump axios ^1.13.4→^1.13.5 (GHSA-43fc-jf86-j433). Add pnpm overrides for lodash/lodash-es >=4.17.23 and undici >=6.23.0 to resolve transitive vulnerabilities via chevrotain and discord.js. Co-Authored-By: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Jason Woltje
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
64077b5169
commit
946d84442a
@@ -50,7 +50,7 @@
|
||||
"@types/multer": "^2.0.0",
|
||||
"adm-zip": "^0.5.16",
|
||||
"archiver": "^7.0.1",
|
||||
"axios": "^1.13.4",
|
||||
"axios": "^1.13.5",
|
||||
"better-auth": "^1.4.17",
|
||||
"bullmq": "^5.67.2",
|
||||
"class-transformer": "^0.5.1",
|
||||
|
||||
+4
-1
@@ -56,7 +56,10 @@
|
||||
},
|
||||
"pnpm": {
|
||||
"overrides": {
|
||||
"@isaacs/brace-expansion": ">=5.0.1"
|
||||
"@isaacs/brace-expansion": ">=5.0.1",
|
||||
"lodash": ">=4.17.23",
|
||||
"lodash-es": ">=4.17.23",
|
||||
"undici": ">=6.23.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Generated
+24
-31
@@ -6,6 +6,9 @@ settings:
|
||||
|
||||
overrides:
|
||||
'@isaacs/brace-expansion': '>=5.0.1'
|
||||
lodash: '>=4.17.23'
|
||||
lodash-es: '>=4.17.23'
|
||||
undici: '>=6.23.0'
|
||||
|
||||
importers:
|
||||
|
||||
@@ -65,7 +68,7 @@ importers:
|
||||
version: link:../../packages/shared
|
||||
'@nestjs/axios':
|
||||
specifier: ^4.0.1
|
||||
version: 4.0.1(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].4)([email protected])
|
||||
version: 4.0.1(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].5)([email protected])
|
||||
'@nestjs/bullmq':
|
||||
specifier: ^11.0.4
|
||||
version: 11.0.4(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])([email protected])
|
||||
@@ -133,8 +136,8 @@ importers:
|
||||
specifier: ^7.0.1
|
||||
version: 7.0.1
|
||||
axios:
|
||||
specifier: ^1.13.4
|
||||
version: 1.13.4
|
||||
specifier: ^1.13.5
|
||||
version: 1.13.5
|
||||
better-auth:
|
||||
specifier: ^1.4.17
|
||||
version: 1.4.17(@prisma/[email protected]([email protected]([email protected])([email protected]))([email protected]))([email protected])([email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])))([email protected](@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected]))([email protected])([email protected]([email protected])([email protected]))([email protected]([email protected]))([email protected])([email protected](@opentelemetry/[email protected])(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]))
|
||||
@@ -3340,8 +3343,8 @@ packages:
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
|
||||
|
||||
[email protected].4:
|
||||
resolution: {integrity: sha512-1wVkUaAO6WyaYtCkcYCOx12ZgpGf9Zif+qXa4n+oYzK558YryKqiL6UWwd5DqiH3VRW0GYhTZQ/vlgJrCoNQlg==}
|
||||
[email protected].5:
|
||||
resolution: {integrity: sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-5Q2mfq2WfGuFp3uS//0s6baOJLMoVduPYVeNmDYxu5OUA1/cBfvr2RIS7vi62LdNj/urk1hfmj867I3qt6uZ7Q==}
|
||||
@@ -4978,9 +4981,6 @@ packages:
|
||||
resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
|
||||
engines: {node: '>=10'}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==}
|
||||
|
||||
@@ -4999,9 +4999,6 @@ packages:
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-QZ1d4xoBHYUeuouhEq3lk3Uq7ldgyFXGBhg04+oRLnIz8o9T65Eh+8YdroUwn846zchkA9yDsDl5CVVaV2nqYw==}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==}
|
||||
|
||||
@@ -6302,9 +6299,9 @@ packages:
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
|
||||
|
||||
undici@6.21.3:
|
||||
resolution: {integrity: sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==}
|
||||
engines: {node: '>=18.17'}
|
||||
undici@7.21.0:
|
||||
resolution: {integrity: sha512-Hn2tCQpoDt1wv23a68Ctc8Cr/BHpUSfaPYrkajTXOS9IKpxVRx/X5m1K2YkbK2ipgZgxXSgsUinl3x+2YdSSfg==}
|
||||
engines: {node: '>=20.18.1'}
|
||||
|
||||
[email protected]:
|
||||
resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
|
||||
@@ -7127,23 +7124,23 @@ snapshots:
|
||||
dependencies:
|
||||
'@chevrotain/gast': 10.5.0
|
||||
'@chevrotain/types': 10.5.0
|
||||
lodash: 4.17.21
|
||||
lodash: 4.17.23
|
||||
|
||||
'@chevrotain/[email protected]':
|
||||
dependencies:
|
||||
'@chevrotain/gast': 11.0.3
|
||||
'@chevrotain/types': 11.0.3
|
||||
lodash-es: 4.17.21
|
||||
lodash-es: 4.17.23
|
||||
|
||||
'@chevrotain/[email protected]':
|
||||
dependencies:
|
||||
'@chevrotain/types': 10.5.0
|
||||
lodash: 4.17.21
|
||||
lodash: 4.17.23
|
||||
|
||||
'@chevrotain/[email protected]':
|
||||
dependencies:
|
||||
'@chevrotain/types': 11.0.3
|
||||
lodash-es: 4.17.21
|
||||
lodash-es: 4.17.23
|
||||
|
||||
'@chevrotain/[email protected]': {}
|
||||
|
||||
@@ -7221,7 +7218,7 @@ snapshots:
|
||||
discord-api-types: 0.38.38
|
||||
magic-bytes.js: 1.13.0
|
||||
tslib: 2.8.1
|
||||
undici: 6.21.3
|
||||
undici: 7.21.0
|
||||
|
||||
'@discordjs/[email protected]':
|
||||
dependencies:
|
||||
@@ -7758,10 +7755,10 @@ snapshots:
|
||||
'@msgpackr-extract/[email protected]':
|
||||
optional: true
|
||||
|
||||
'@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].4)([email protected])':
|
||||
'@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].5)([email protected])':
|
||||
dependencies:
|
||||
'@nestjs/common': 11.1.12([email protected])([email protected])([email protected])([email protected])
|
||||
axios: 1.13.4
|
||||
axios: 1.13.5
|
||||
rxjs: 7.8.2
|
||||
|
||||
'@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])':
|
||||
@@ -7826,7 +7823,7 @@ snapshots:
|
||||
'@nestjs/common': 11.1.12([email protected])([email protected])([email protected])([email protected])
|
||||
dotenv: 16.4.7
|
||||
dotenv-expand: 12.0.1
|
||||
lodash: 4.17.21
|
||||
lodash: 4.17.23
|
||||
rxjs: 7.8.2
|
||||
|
||||
'@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])(@nestjs/[email protected])([email protected])([email protected])':
|
||||
@@ -9932,7 +9929,7 @@ snapshots:
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected].4:
|
||||
[email protected].5:
|
||||
dependencies:
|
||||
follow-redirects: 1.15.11
|
||||
form-data: 4.0.5
|
||||
@@ -10213,7 +10210,7 @@ snapshots:
|
||||
'@chevrotain/gast': 10.5.0
|
||||
'@chevrotain/types': 10.5.0
|
||||
'@chevrotain/utils': 10.5.0
|
||||
lodash: 4.17.21
|
||||
lodash: 4.17.23
|
||||
regexp-to-ast: 0.5.0
|
||||
|
||||
[email protected]:
|
||||
@@ -10223,7 +10220,7 @@ snapshots:
|
||||
'@chevrotain/regexp-to-ast': 11.0.3
|
||||
'@chevrotain/types': 11.0.3
|
||||
'@chevrotain/utils': 11.0.3
|
||||
lodash-es: 4.17.21
|
||||
lodash-es: 4.17.23
|
||||
|
||||
[email protected]:
|
||||
dependencies:
|
||||
@@ -10691,7 +10688,7 @@ snapshots:
|
||||
lodash.snakecase: 4.1.1
|
||||
magic-bytes.js: 1.13.0
|
||||
tslib: 2.8.1
|
||||
undici: 6.21.3
|
||||
undici: 7.21.0
|
||||
transitivePeerDependencies:
|
||||
- bufferutil
|
||||
- utf-8-validate
|
||||
@@ -11614,8 +11611,6 @@ snapshots:
|
||||
dependencies:
|
||||
p-locate: 5.0.0
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected]: {}
|
||||
@@ -11628,8 +11623,6 @@ snapshots:
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
[email protected]:
|
||||
@@ -13036,7 +13029,7 @@ snapshots:
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
undici@6.21.3: {}
|
||||
undici@7.21.0: {}
|
||||
|
||||
[email protected]: {}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user