fix(deps): patch axios DoS and transitive prototype pollution/decompression vulns

Bump axios ^1.13.4→^1.13.5 (GHSA-43fc-jf86-j433). Add pnpm overrides for
lodash/lodash-es >=4.17.23 and undici >=6.23.0 to resolve transitive
vulnerabilities via chevrotain and discord.js.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

apps/api/package.json

@@ -50,7 +50,7 @@
     "@types/multer": "^2.0.0",
     "adm-zip": "^0.5.16",
     "archiver": "^7.0.1",
-    "axios": "^1.13.4",
+    "axios": "^1.13.5",
     "better-auth": "^1.4.17",
     "bullmq": "^5.67.2",
     "class-transformer": "^0.5.1",

package.json

@@ -56,7 +56,10 @@
   },
   "pnpm": {
     "overrides": {
-      "@isaacs/brace-expansion": ">=5.0.1"
+      "@isaacs/brace-expansion": ">=5.0.1",
+      "lodash": ">=4.17.23",
+      "lodash-es": ">=4.17.23",
+      "undici": ">=6.23.0"
     }
   }
 }

pnpm-lock.yaml

@@ -6,6 +6,9 @@ settings:
 
 overrides:
   '@isaacs/brace-expansion': '>=5.0.1'
+  lodash: '>=4.17.23'
+  lodash-es: '>=4.17.23'
+  undici: '>=6.23.0'
 
 importers:
 
@@ -65,7 +68,7 @@ importers:
         version: link:../../packages/shared
       '@nestjs/axios':
         specifier: ^4.0.1
-        version: 4.0.1(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].4)([email protected])
+        version: 4.0.1(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].5)([email protected])
       '@nestjs/bullmq':
         specifier: ^11.0.4
         version: 11.0.4(@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])([email protected])
@@ -133,8 +136,8 @@ importers:
         specifier: ^7.0.1
         version: 7.0.1
       axios:
-        specifier: ^1.13.4
+        specifier: ^1.13.5
-        version: 1.13.4
+        version: 1.13.5
       better-auth:
         specifier: ^1.4.17
         version: 1.4.17(@prisma/[email protected]([email protected]([email protected])([email protected]))([email protected]))([email protected])([email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])))([email protected](@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected]))([email protected])([email protected]([email protected])([email protected]))([email protected]([email protected]))([email protected])([email protected](@opentelemetry/[email protected])(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]))
@@ -3340,8 +3343,8 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
 
-  [email protected].4:
+  [email protected].5:
-    resolution: {integrity: sha512-1wVkUaAO6WyaYtCkcYCOx12ZgpGf9Zif+qXa4n+oYzK558YryKqiL6UWwd5DqiH3VRW0GYhTZQ/vlgJrCoNQlg==}
+    resolution: {integrity: sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==}
 
   [email protected]:
     resolution: {integrity: sha512-5Q2mfq2WfGuFp3uS//0s6baOJLMoVduPYVeNmDYxu5OUA1/cBfvr2RIS7vi62LdNj/urk1hfmj867I3qt6uZ7Q==}
@@ -4978,9 +4981,6 @@ packages:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
     engines: {node: '>=10'}
 
-  [email protected]:
-    resolution: {integrity: sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==}
-
   [email protected]:
     resolution: {integrity: sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==}
 
@@ -4999,9 +4999,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-QZ1d4xoBHYUeuouhEq3lk3Uq7ldgyFXGBhg04+oRLnIz8o9T65Eh+8YdroUwn846zchkA9yDsDl5CVVaV2nqYw==}
 
-  [email protected]:
-    resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==}
-
   [email protected]:
     resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==}
 
@@ -6302,9 +6299,9 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@6.21.3:
+  undici@7.21.0:
-    resolution: {integrity: sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==}
+    resolution: {integrity: sha512-Hn2tCQpoDt1wv23a68Ctc8Cr/BHpUSfaPYrkajTXOS9IKpxVRx/X5m1K2YkbK2ipgZgxXSgsUinl3x+2YdSSfg==}
-    engines: {node: '>=18.17'}
+    engines: {node: '>=20.18.1'}
 
   [email protected]:
     resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
@@ -7127,23 +7124,23 @@ snapshots:
     dependencies:
       '@chevrotain/gast': 10.5.0
       '@chevrotain/types': 10.5.0
-      lodash: 4.17.21
+      lodash: 4.17.23
 
   '@chevrotain/[email protected]':
     dependencies:
       '@chevrotain/gast': 11.0.3
       '@chevrotain/types': 11.0.3
-      lodash-es: 4.17.21
+      lodash-es: 4.17.23
 
   '@chevrotain/[email protected]':
     dependencies:
       '@chevrotain/types': 10.5.0
-      lodash: 4.17.21
+      lodash: 4.17.23
 
   '@chevrotain/[email protected]':
     dependencies:
       '@chevrotain/types': 11.0.3
-      lodash-es: 4.17.21
+      lodash-es: 4.17.23
 
   '@chevrotain/[email protected]': {}
 
@@ -7221,7 +7218,7 @@ snapshots:
       discord-api-types: 0.38.38
       magic-bytes.js: 1.13.0
       tslib: 2.8.1
-      undici: 6.21.3
+      undici: 7.21.0
 
   '@discordjs/[email protected]':
     dependencies:
@@ -7758,10 +7755,10 @@ snapshots:
   '@msgpackr-extract/[email protected]':
     optional: true
 
-  '@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].4)([email protected])':
+  '@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))([email protected].5)([email protected])':
     dependencies:
       '@nestjs/common': 11.1.12([email protected])([email protected])([email protected])([email protected])
-      axios: 1.13.4
+      axios: 1.13.5
       rxjs: 7.8.2
 
   '@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])':
@@ -7826,7 +7823,7 @@ snapshots:
       '@nestjs/common': 11.1.12([email protected])([email protected])([email protected])([email protected])
       dotenv: 16.4.7
       dotenv-expand: 12.0.1
-      lodash: 4.17.21
+      lodash: 4.17.23
       rxjs: 7.8.2
 
   '@nestjs/[email protected](@nestjs/[email protected]([email protected])([email protected])([email protected])([email protected]))(@nestjs/[email protected])(@nestjs/[email protected])([email protected])([email protected])':
@@ -9932,7 +9929,7 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected].4:
+  [email protected].5:
     dependencies:
       follow-redirects: 1.15.11
       form-data: 4.0.5
@@ -10213,7 +10210,7 @@ snapshots:
       '@chevrotain/gast': 10.5.0
       '@chevrotain/types': 10.5.0
       '@chevrotain/utils': 10.5.0
-      lodash: 4.17.21
+      lodash: 4.17.23
       regexp-to-ast: 0.5.0
 
   [email protected]:
@@ -10223,7 +10220,7 @@ snapshots:
       '@chevrotain/regexp-to-ast': 11.0.3
       '@chevrotain/types': 11.0.3
       '@chevrotain/utils': 11.0.3
-      lodash-es: 4.17.21
+      lodash-es: 4.17.23
 
   [email protected]:
     dependencies:
@@ -10691,7 +10688,7 @@ snapshots:
       lodash.snakecase: 4.1.1
       magic-bytes.js: 1.13.0
       tslib: 2.8.1
-      undici: 6.21.3
+      undici: 7.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -11614,8 +11611,6 @@ snapshots:
     dependencies:
       p-locate: 5.0.0
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]: {}
@@ -11628,8 +11623,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]:
@@ -13036,7 +13029,7 @@ snapshots:
 
   [email protected]: {}
 
-  undici@6.21.3: {}
+  undici@7.21.0: {}
 
   [email protected]: {}