From e1854cf587cfbfee733d0f0c980ca42edd52c981 Mon Sep 17 00:00:00 2001 From: ddryo <31400297+ddryo@users.noreply.github.com> Date: Wed, 30 Sep 2026 13:36:12 +0900 Subject: [PATCH] =?UTF-8?q?chore(deps):=20Dependabot=20alert=208=E4=BB=B6?= =?UTF-8?q?=EF=BC=88undici=E3=83=BBbrace-expansion=EF=BC=89=E3=81=AB?= =?UTF-8?q?=E5=AF=BE=E5=BF=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - undiciのoverrideを^7.29.1へ引き上げ（#261-#268、miniflare由来） - brace-expansion 1.x のoverrideを^1.1.21へ引き上げ（#274、minimatch@3由来） - brace-expansion 5.x はlockfileのみ5.0.12へ更新（#273、minimatch@10由来） Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01QVLjowgyFC3LjAypkdh6PW --- pnpm-lock.yaml | 30 +++++++++++++++--------------- pnpm-workspace.yaml | 4 ++-- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 73be77c14..fce130387 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -14,9 +14,9 @@ overrides: '@hono/node-server@<1.19.15': ^1.19.15 postcss@<8.5.23: ^8.5.23 esbuild@>=0.27.3 <0.28.1: ^0.28.1 - undici@>=7 <7.29.0: ^7.29.0 + undici@>=7 <7.29.1: ^7.29.1 ip-address@<10.5.1: ^10.5.1 - brace-expansion@<1.1.16: ^1.1.16 + brace-expansion@<1.1.21: ^1.1.21 svgo@>=4 <4.1.0: ^4.1.0 fflate@>=0.7.0 <0.7.5: ^0.7.5 @@ -4159,12 +4159,12 @@ packages: boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} - brace-expansion@1.1.17: - resolution: {integrity: sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -7558,8 +7558,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.29.1: + resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} undici@8.10.2: @@ -11774,12 +11774,12 @@ snapshots: boolbase@1.0.0: {} - brace-expansion@1.1.17: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.7: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -14179,7 +14179,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.4(@types/node@26.1.0) - undici: 7.29.0 + undici: 7.29.1 workerd: 1.20260921.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -14190,11 +14190,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.17 + brace-expansion: 1.1.21 minimist@1.2.8: {} @@ -16142,7 +16142,7 @@ snapshots: undici-types@8.3.0: optional: true - undici@7.29.0: {} + undici@7.29.1: {} undici@8.10.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 31b8d04d0..62efa038c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -19,9 +19,9 @@ overrides: '@hono/node-server@<1.19.15': '^1.19.15' # GHSA: Middleware bypass via repeated slashes (#82) / Windows の serve-static でのパストラバーサル (#207) 'postcss@<8.5.23': '^8.5.23' # GHSA: XSS via Unescaped (#91) / sourceMappingURL 経由の任意 .map 読み取り (#186, #193)。next@16 が 8.4.31 を固定ピンしているため override が必要 'esbuild@>=0.27.3 <0.28.1': '^0.28.1' # GHSA: dev server での arbitrary file read on Windows (#113)。astro/tsup が ^0.27 系要求のため override が必要 - 'undici@>=7 <7.29.0': '^7.29.0' # GHSA: private cache directive 経由の情報漏洩 / CRLF injection 等 (#195-#199)。miniflare 由来 + 'undici@>=7 <7.29.1': '^7.29.1' # GHSA: private cache directive 経由の情報漏洩 / CRLF injection / BalancedPool での TLS 検証バイパス 等 (#195-#199, #261-#268)。miniflare 由来 'ip-address@<10.5.1': '^10.5.1' # GHSA: 先頭ゼロ8進数の解釈差や NAT64 範囲の判定漏れによる SSRF / trust-boundary バイパス (#187, #188, #200, #259)。express-rate-limit 由来 - 'brace-expansion@<1.1.16': '^1.1.16' # GHSA: 連続する {} の指数時間展開による DoS (#183)。minimatch@3 由来 + 'brace-expansion@<1.1.21': '^1.1.21' # GHSA: 連続する {} の指数時間展開 / `{a},b}` の二乗時間展開による DoS (#183, #274)。minimatch@3 由来 'svgo@>=4 <4.1.0': '^4.1.0' # GHSA: removeScripts プラグインが一部の実行可能スクリプトやリンクを残す (#171, #218, #219) 'fflate@>=0.7.0 <0.7.5': '^0.7.5' # GHSA: 不正な ZIP64 で unzipSync が無限ループ (#214)。satori が 0.7.3 を固定ピンしているため override が必要