From 92fbeee47bfa37d367bb746227485630458c76a6 Mon Sep 17 00:00:00 2001 From: gusthoff Date: Sat, 26 Sep 2026 01:43:03 +0200 Subject: [PATCH] Frontend: pin dependencies flagged by pnpm audit `pnpm audit` reported 18 findings (10 high, 7 moderate, 1 low) across seven packages, all new advisories published since the 2026-07-24 `pnpm-workspace.yaml` overrides fix. Bump the four existing overrides and add three new ones, each to the version its own advisories are fixed at: - `brace-expansion` ^5.0.7 -> ^5.0.9 (GHSA-rgw5-rvv9-x895, DoS via unbounded intermediate arrays) - `fast-uri` -> ^3.1.6, new override (GHSA-7p8r-x3mc-p8w7, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp; host-confusion and SSRF issues, pulled in via `ajv`, used by webpack's schema validation) - `js-yaml` ^4.3.0 -> ^4.3.2 (GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh; quadratic CPU consumption in merge-key/omap handling, pulled in via `webpack-cli`) - `postcss-selector-parser` -> ^7.1.3, new override (GHSA-w9m9-85wc-3x92, DoS via uncontrolled AST recursion, pulled in via `css-loader`'s CSS-modules plugins) - `qs` -> ^6.16.0, new override (GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g; array-limit bypass and isBuffer DoS, pulled in via `webpack-dev-server`'s `express` dependency) - `svgo` ^4.0.2 -> ^4.1.0 (GHSA-w27v-7q3p-w38r, GHSA-4vpr-x523-8j87; `removeScripts` executable-content bypasses, pulled in via the production CSS minification pipeline) - `undici` ^7.28.0 -> ^7.29.0 (GHSA-4cwx-7wf7-3272 plus four moderate advisories; cache/cookie/CRLF handling issues, pulled in via `jsdom` for the mocha test suite's DOM environment) All seven are transitive dependencies of build and test tooling only (webpack, its plugins, and jsdom); none ship in the compiled site bundle. Verified: `pnpm audit` now reports 0 vulnerabilities (was 18). `pnpm run cover` (126 passing, coverage unchanged at 99.94% statements / 97.42% branches), `pnpm run production` (clean compile, unchanged pre-existing bundle-size warnings), and `pnpm run eslint` (0 problems) all behave identically to before the overrides. Co-Authored-By: Claude Sonnet 5 --- frontend/pnpm-lock.yaml | 127 +++++++++++++++++++---------------- frontend/pnpm-workspace.yaml | 11 +-- 2 files changed, 75 insertions(+), 63 deletions(-) diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index 0134b27b7..94c52c47e 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -6,12 +6,15 @@ settings: overrides: serialize-javascript: ^7.0.5 - brace-expansion: ^5.0.7 - js-yaml: ^4.3.0 + brace-expansion: ^5.0.9 + js-yaml: ^4.3.2 immutable: ^5.1.8 mocha>diff: ^9.0.0 - undici: ^7.28.0 - svgo: ^4.0.2 + undici: ^7.29.0 + svgo: ^4.1.0 + fast-uri: ^3.1.6 + qs: ^6.16.0 + postcss-selector-parser: ^7.1.3 importers: @@ -206,7 +209,7 @@ importers: version: 5.108.4(postcss@8.5.23)(webpack-cli@7.2.1) webpack-cli: specifier: ^7.2.1 - version: 7.2.1(js-yaml@4.3.0)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) + version: 7.2.1(js-yaml@4.3.2)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) webpack-dev-server: specifier: ^6.0.0 version: 6.0.0(tslib@2.8.1)(webpack-cli@7.2.1)(webpack@5.108.4) @@ -1588,8 +1591,8 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -1852,8 +1855,8 @@ packages: css-select@4.3.0: resolution: {integrity: sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==} - css-select@5.2.2: - resolution: {integrity: sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==} + css-select@6.0.0: + resolution: {integrity: sha512-rZZVSLle8v0+EY8QAkDWrKhpgt6SA5OtHsgBnsj6ZaLb5dmDVOWUDtQitd9ydxxvEjhewNudS6eTVU7uOyzvXw==} css-tree@2.2.1: resolution: {integrity: sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA==} @@ -1867,6 +1870,10 @@ packages: resolution: {integrity: sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==} engines: {node: '>= 6'} + css-what@7.0.0: + resolution: {integrity: sha512-wD5oz5xibMOPHzy13CyGmogB3phdvcDaB5t0W/Nr5Z2O/agcB8YwOz6e2Lsp10pNDzBoDO9nVa3RGs/2BttpHQ==} + engines: {node: '>= 6'} + cssesc@3.0.0: resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==} engines: {node: '>=4'} @@ -2175,8 +2182,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -2584,8 +2591,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsdoc-type-pratt-parser@7.2.0: @@ -3262,8 +3269,8 @@ packages: peerDependencies: postcss: ^8.5.13 - postcss-selector-parser@7.1.1: - resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==} + postcss-selector-parser@7.1.6: + resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==} engines: {node: '>=4'} postcss-svgo@7.1.3: @@ -3322,8 +3329,8 @@ packages: resolution: {integrity: sha512-S+pEGEYdeTKBuVVKqTpMwUKC3hJpX+3Hql+L/w9rUO+q+TlRV2IILmnDyC2sbAwn1nDrStpedVBzlLtXTfX4LA==} engines: {node: '>=0.4'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} range-parser@1.3.0: @@ -3454,8 +3461,8 @@ packages: engines: {node: '>=20.19.0'} hasBin: true - sax@1.6.0: - resolution: {integrity: sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==} + sax@1.6.1: + resolution: {integrity: sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==} engines: {node: '>=11.0.0'} saxes@6.0.0: @@ -3633,8 +3640,8 @@ packages: resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==} engines: {node: '>= 0.4'} - svgo@4.0.2: - resolution: {integrity: sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==} + svgo@4.1.0: + resolution: {integrity: sha512-bkxnTg1kSU0guhIBmibA6UUhrQmPVA1XsQLN+ylCd+UWzbnLkySOcXpyk1mrl05f+pcaCx2eHb+sp6BgMZWX+Q==} engines: {node: '>=16'} hasBin: true @@ -3821,8 +3828,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.1: + resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -3892,7 +3899,7 @@ packages: engines: {node: '>=20.9.0'} hasBin: true peerDependencies: - js-yaml: ^4.3.0 + js-yaml: ^4.3.2 json5: ^2.2.3 toml: ^3.0.0 || ^4.0.0 webpack: ^5.101.0 @@ -5513,7 +5520,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -5593,7 +5600,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -5606,7 +5613,7 @@ snapshots: boolbase@1.0.0: {} - brace-expansion@5.0.8: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -5791,7 +5798,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.0 + js-yaml: 4.3.2 parse-json: 5.2.0 optionalDependencies: typescript: 6.0.3 @@ -5844,10 +5851,10 @@ snapshots: domutils: 2.8.0 nth-check: 2.1.1 - css-select@5.2.2: + css-select@6.0.0: dependencies: boolbase: 1.0.0 - css-what: 6.2.2 + css-what: 7.0.0 domhandler: 5.0.3 domutils: 3.2.2 nth-check: 2.1.1 @@ -5864,6 +5871,8 @@ snapshots: css-what@6.2.2: {} + css-what@7.0.0: {} + cssesc@3.0.0: {} cssnano-preset-default@7.0.17(postcss@8.5.23): @@ -6207,7 +6216,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.7 - qs: 6.15.3 + qs: 6.16.0 range-parser: 1.3.0 router: 2.2.0 send: 1.2.1 @@ -6224,7 +6233,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.4: {} + fast-uri@3.1.8: {} fdir@6.5.0(picomatch@4.0.5): optionalDependencies: @@ -6616,7 +6625,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.3.0: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -6643,7 +6652,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.1 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -6825,15 +6834,15 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.12 minimatch@9.0.9: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -6860,7 +6869,7 @@ snapshots: glob: 10.5.0 he: 1.2.0 is-path-inside: 3.0.3 - js-yaml: 4.3.0 + js-yaml: 4.3.2 log-symbols: 4.1.0 minimatch: 9.0.9 ms: 2.1.3 @@ -7071,7 +7080,7 @@ snapshots: postcss-calc@10.1.1(postcss@8.5.23): dependencies: postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-value-parser: 4.2.0 postcss-colormin@7.0.10(postcss@8.5.23): @@ -7091,7 +7100,7 @@ snapshots: postcss-discard-comments@7.0.8(postcss@8.5.23): dependencies: postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-discard-duplicates@7.0.4(postcss@8.5.23): dependencies: @@ -7128,7 +7137,7 @@ snapshots: caniuse-api: 3.0.0 cssnano-utils: 5.0.3(postcss@8.5.23) postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-minify-font-values@7.0.3(postcss@8.5.23): dependencies: @@ -7155,7 +7164,7 @@ snapshots: caniuse-api: 3.0.0 cssesc: 3.0.0 postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-modules-extract-imports@3.1.0(postcss@8.5.23): dependencies: @@ -7165,13 +7174,13 @@ snapshots: dependencies: icss-utils: 5.1.0(postcss@8.5.23) postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-value-parser: 4.2.0 postcss-modules-scope@3.2.1(postcss@8.5.23): dependencies: postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-modules-values@4.0.0(postcss@8.5.23): dependencies: @@ -7240,7 +7249,7 @@ snapshots: postcss: 8.5.23 postcss-value-parser: 4.2.0 - postcss-selector-parser@7.1.1: + postcss-selector-parser@7.1.6: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -7249,12 +7258,12 @@ snapshots: dependencies: postcss: 8.5.23 postcss-value-parser: 4.2.0 - svgo: 4.0.2 + svgo: 4.1.0 postcss-unique-selectors@7.0.7(postcss@8.5.23): dependencies: postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 postcss-value-parser@4.2.0: {} @@ -7292,7 +7301,7 @@ snapshots: pygments@0.2.1: {} - qs@6.15.3: + qs@6.16.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -7415,7 +7424,7 @@ snapshots: optionalDependencies: '@parcel/watcher': 2.5.6 - sax@1.6.0: {} + sax@1.6.1: {} saxes@6.0.0: dependencies: @@ -7598,7 +7607,7 @@ snapshots: dependencies: browserslist: 4.28.7 postcss: 8.5.23 - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.6 supports-color@7.2.0: dependencies: @@ -7610,15 +7619,15 @@ snapshots: supports-preserve-symlinks-flag@1.0.0: {} - svgo@4.0.2: + svgo@4.1.0: dependencies: commander: 11.1.0 - css-select: 5.2.2 + css-select: 6.0.0 css-tree: 3.2.1 - css-what: 6.2.2 + css-what: 7.0.0 csso: 5.0.5 picocolors: 1.1.1 - sax: 1.6.0 + sax: 1.6.1 symbol-tree@3.2.4: {} @@ -7763,7 +7772,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.28.0: {} + undici@7.29.1: {} unicode-canonical-property-names-ecmascript@2.0.1: {} @@ -7814,7 +7823,7 @@ snapshots: webidl-conversions@8.0.1: {} - webpack-cli@7.2.1(js-yaml@4.3.0)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4): + webpack-cli@7.2.1(js-yaml@4.3.2)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4): dependencies: '@discoveryjs/json-ext': 1.1.0 commander: 14.0.3 @@ -7826,7 +7835,7 @@ snapshots: webpack: 5.108.4(postcss@8.5.23)(webpack-cli@7.2.1) webpack-merge: 6.0.1 optionalDependencies: - js-yaml: 4.3.0 + js-yaml: 4.3.2 json5: 2.2.3 webpack-dev-server: 6.0.0(tslib@2.8.1)(webpack-cli@7.2.1)(webpack@5.108.4) @@ -7870,7 +7879,7 @@ snapshots: ws: 8.21.1 optionalDependencies: webpack: 5.108.4(postcss@8.5.23)(webpack-cli@7.2.1) - webpack-cli: 7.2.1(js-yaml@4.3.0)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) + webpack-cli: 7.2.1(js-yaml@4.3.2)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) transitivePeerDependencies: - bufferutil - supports-color @@ -7922,7 +7931,7 @@ snapshots: watchpack: 2.5.2 webpack-sources: 3.5.1 optionalDependencies: - webpack-cli: 7.2.1(js-yaml@4.3.0)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) + webpack-cli: 7.2.1(js-yaml@4.3.2)(json5@2.2.3)(webpack-dev-server@6.0.0)(webpack@5.108.4) transitivePeerDependencies: - '@minify-html/node' - '@swc/core' diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml index 6befbf54d..3a2f23b67 100644 --- a/frontend/pnpm-workspace.yaml +++ b/frontend/pnpm-workspace.yaml @@ -4,9 +4,12 @@ allowBuilds: overrides: serialize-javascript: ^7.0.5 - brace-expansion: ^5.0.7 - js-yaml: ^4.3.0 + brace-expansion: ^5.0.9 + js-yaml: ^4.3.2 immutable: ^5.1.8 mocha>diff: ^9.0.0 - undici: ^7.28.0 - svgo: ^4.0.2 + undici: ^7.29.0 + svgo: ^4.1.0 + fast-uri: ^3.1.6 + qs: ^6.16.0 + postcss-selector-parser: ^7.1.3