mirror of
https://github.com/MODSetter/SurfSense.git
synced 2026-10-21 05:05:36 +00:00
187f6de102
Direct dependencies - next ^16.2.12 -> ^16.3.6 (critical): GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4, GHSA-vcvr-r3jv-pc5j. 16.3.6 also moves its pinned postcss 8.4.31 -> 8.5.23 and sharp 0.34.5 -> 0.35.4 (GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c). 16.3.7/16.3.8 are inside the 7-day minimumReleaseAge window. - mermaid ^11.15.0 -> ^11.16.1 (locks 11.17.2): GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-c4c3-pg64-4m4v, GHSA-rhh3-jpg6-66xh - vite ^7.3.1 -> ^7.3.5 (locks 7.3.6): GHSA-v2wj-q39q-566r, GHSA-4w7w-66w2-5vf9, GHSA-p9ff-h696-f583, GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3 - ai ^4.3.19 and @ai-sdk/react ^1.2.12 removed: nothing imports them since the chat moved to its own transport (947087452,48fc70a08). Clears ai GHSA-rwvc-j5jr-mgvh, @ai-sdk/provider-utils GHSA-866g-f22w-33x8 and jsondiffpatch GHSA-33vc-wfww-vjfv, GHSA-j4fx-xxwh-2485 without the AI SDK v5 migration. Transitive, updated inside their parents' ranges - brace-expansion 1.1.21 / 2.1.7 (5.x copy gone), minimatch 3.1.5 / 9.0.9, picomatch 2.3.2 / 4.0.7, nanoid 3.3.19 / 5.1.16, postcss 8.5.28, fastify 5.12.5, find-my-way 9.9.0, fast-uri 3.1.8, @grpc/grpc-js 1.14.5, protobufjs 7.6.6, ws 8.21.3, undici 6.28.1, svgo 3.3.5, js-yaml 4.3.2, lodash 4.18.1, markdown-it 14.3.2, image-size 2.0.4, path-to-regexp 8.4.2, postcss-selector-parser 7.1.6, fflate 0.4.9, flatted 3.4.4, @humanfs/node 0.16.8, @babel/core 7.29.7, @babel/plugin-transform-modules-systemjs 7.29.8, baseline-browser-mapping 2.11.25, browserslist 4.29.0 - esbuild 0.27.3 -> 0.28.2 (GHSA-g7r4-m6w7-qqqr) by locking tsx 4.23.15 and fumadocs-mdx 14.3.0. fumadocs-mdx 14.3.1+ imports fumadocs-core/content/md/frontmatter, which fumadocs-core 16.6.5 lacks, so its postinstall fails; 14.3.0 is the last that works. Overrides (pnpm-workspace.yaml), for parents that pin a vulnerable copy - dompurify >=3.4.13 (monaco-editor pins 3.2.7; locks 3.4.16): all 18 dompurify advisories in the alert list - prismjs >=1.30.0 (refractor 3 pins ~1.27.0): GHSA-x7hr-w5r2-h6wg - @opentelemetry/core >=2.8.0 (GHSA-8988-4f7v-96qf) and propagator-jaeger >=2.9.0 (GHSA-45rx-2jwx-cxfr), both inside 2.x - @rocicorp/zero's sdk-node, auto-instrumentations-node, api-logs and exporter-metrics-otlp-http moved to the ranges @rocicorp/zero 1.7.0 declares (^0.218.0 / ^0.76.0): GHSA-q7rr-3cgh-j5r3 on sdk-node, exporter-prometheus and auto-instrumentations-node. Zero stays on 1.6.0 to match the rocicorp/zero:1.6.0 image (83fdef218); its otel-start code is identical in 1.7.0, these packages only run inside zero-cache and are not traced into the web build. - uuid ^11.1.1 for cloudevents and exceljs (GHSA-w5hq-g745-h8pq): a cross-major override; both only call v4(), unchanged in 11.x, which still ships CommonJS. mermaid keeps uuid 14. Deferred - @platejs/core 52.0.17 (GHSA-qrfj-mgw8-j9c6, medium) is fixed only in 53.3.11; Plate 53 changes the blockquote value shape and markdown output and drops useTableElement().isSelectingCell, across ~50 editor files with no tests over them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
packages:
|
|
- "."
|
|
|
|
allowBuilds:
|
|
"@parcel/watcher": true
|
|
"@rocicorp/zero-sqlite3": true
|
|
"@swc/core": true
|
|
core-js: true
|
|
esbuild: true
|
|
protobufjs: true
|
|
sharp: true
|
|
unrs-resolver: true
|
|
|
|
minimumReleaseAge: 10080
|
|
minimumReleaseAgeExclude:
|
|
- lucide-react
|
|
|
|
# Security floors for transitive dependencies whose parents pin a vulnerable
|
|
# version. Each stays inside the major its dependents use, except the
|
|
# @rocicorp/zero OpenTelemetry set (the ranges @rocicorp/zero 1.7.0 ships; zero
|
|
# stays on 1.6.0 to match the rocicorp/zero:1.6.0 image) and uuid for
|
|
# cloudevents and exceljs (both only call v4(), unchanged in 11.x, which still
|
|
# ships CommonJS).
|
|
overrides:
|
|
"@opentelemetry/core@>=2.0.0 <2.8.0": "^2.8.0"
|
|
"@opentelemetry/propagator-jaeger@>=2.0.0 <2.9.0": "^2.9.0"
|
|
"@rocicorp/zero>@opentelemetry/api-logs": "^0.218.0"
|
|
"@rocicorp/zero>@opentelemetry/auto-instrumentations-node": "^0.76.0"
|
|
"@rocicorp/zero>@opentelemetry/exporter-metrics-otlp-http": "^0.218.0"
|
|
"@rocicorp/zero>@opentelemetry/sdk-node": "^0.218.0"
|
|
"dompurify@>=3.0.0 <3.4.13": "^3.4.13"
|
|
"prismjs@>=1.0.0 <1.30.0": "^1.30.0"
|
|
"cloudevents>uuid": "^11.1.1"
|
|
"exceljs>uuid": "^11.1.1"
|