tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-07 04:12:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): raise the floors for body-parser, fast-uri and undici 7

Browse Source 
body-parser 2.3.0 (CVE-2026-111181, high) and fast-uri 3.1.8
(CVE-2026-110180, CVE-2026-110306) arrive under the MCP SDK on a
production path. undici 7.30.0 (CVE-2026-109869, CVE-2026-109841,
CVE-2026-109924) is the development-only copy under shadcn; the app's
own undici 8 is already past the fix. Each bound moves the flagged copy
and nothing else.
This commit is contained in:
Marc-André Bombeck committed 2026-10-24 18:11:21 +02:00
1 parent 6748a5b843
commit 087d0011fc
2 files changed
+36 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pnpm-lock.yaml
Generated
+27 -18
View File
@@ -14,12 +14,12 @@ overrides:
nanoid@<3.3.18: ^3.3.18
'@hono/node-server@<1.19.15': ^1.19.15
picomatch@<4.0.4: ^4.0.4
body-parser@<2.3.0: ^2.3.0
body-parser@<2.4.0: ^2.4.0
source-map-js@<1.2.2: ^1.2.2
postcss-selector-parser@<7.1.6: ^7.1.6
smol-toml@<1.9.0: ^1.9.0
qs@<6.16.0: ^6.16.0
fast-uri@<3.1.8: ^3.1.8
fast-uri@<3.1.9: ^3.1.9
flatted@<3.4.2: ^3.4.2
proxy-addr@<2.0.8: ^2.0.8
mysql2@<3.22.0: ^3.22.0
@@ -35,7 +35,7 @@ overrides:
brace-expansion@<1.1.21: ^1.1.21
brace-expansion@>=2.0.0 <2.1.7: ^2.1.7
brace-expansion@>=4.0.0 <5.0.12: ^5.0.12
undici@>=7.0.0 <7.29.1: ^7.29.1
undici@>=7.0.0 <7.30.1: ^7.30.1
vite@>=8.0.0 <8.1.6: ^8.1.6
patchedDependencies:
@@ -3730,8 +3730,8 @@ packages:
bn.js@4.12.3:
resolution: {integrity: sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==}
body-parser@2.3.0:
resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
body-parser@2.4.0:
resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==}
engines: {node: '>=18'}
bowser@2.14.1:
@@ -4555,8 +4555,8 @@ packages:
fast-string-width@3.0.2:
resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
fast-uri@3.1.8:
resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
fast-uri@3.1.9:
resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==}
fast-wrap-ansi@0.2.2:
resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -6199,6 +6199,10 @@ packages:
resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==}
engines: {node: '>=0.6'}
qs@6.16.1:
resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==}
engines: {node: '>=0.6'}
queue-microtask@1.2.3:
resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
@@ -6960,8 +6964,8 @@ packages:
undici-types@8.9.0:
resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
undici@7.30.0:
resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==}
undici@7.30.1:
resolution: {integrity: sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==}
engines: {node: '>=20.18.1'}
undici@8.12.3:
@@ -7991,7 +7995,7 @@ snapshots:
open: 8.4.2
picomatch: 4.0.7
systeminformation: 5.33.15
undici: 7.30.0
undici: 7.30.1
which: 4.0.0
yocto-spinner: 1.2.2
@@ -9986,7 +9990,7 @@ snapshots:
stringify-object: 5.0.0
tsconfig-paths: 4.2.0
type-fest: 4.41.0
undici: 7.30.0
undici: 7.30.1
zod: 4.6.7
transitivePeerDependencies:
- supports-color
@@ -10740,7 +10744,7 @@ snapshots:
ajv@8.20.0:
dependencies:
fast-deep-equal: 3.1.3
fast-uri: 3.1.8
fast-uri: 3.1.9
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
@@ -10966,7 +10970,7 @@ snapshots:
bn.js@4.12.3: {}
body-parser@2.3.0(supports-color@7.2.0):
body-parser@2.4.0(supports-color@7.2.0):
dependencies:
bytes: 3.1.2
content-type: 2.1.0
@@ -10974,7 +10978,7 @@ snapshots:
http-errors: 2.0.1
iconv-lite: 0.7.3
on-finished: 2.4.1
qs: 6.16.0
qs: 6.16.1
raw-body: 3.0.2
type-is: 2.1.0
transitivePeerDependencies:
@@ -11878,7 +11882,7 @@ snapshots:
express@5.2.1(supports-color@7.2.0):
dependencies:
accepts: 2.0.0
body-parser: 2.3.0(supports-color@7.2.0)
body-parser: 2.4.0(supports-color@7.2.0)
content-disposition: 1.1.0
content-type: 1.0.5
cookie: 0.7.2
@@ -11962,7 +11966,7 @@ snapshots:
dependencies:
fast-string-truncated-width: 3.0.3
fast-uri@3.1.8: {}
fast-uri@3.1.9: {}
fast-wrap-ansi@0.2.2:
dependencies:
@@ -13471,6 +13475,11 @@ snapshots:
es-define-property: 1.0.1
side-channel: 1.1.1
qs@6.16.1:
dependencies:
es-define-property: 1.0.1
side-channel: 1.1.1
queue-microtask@1.2.3: {}
radix-ui@1.8.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.1(react@19.3.1))(react@19.3.1):
@@ -13918,7 +13927,7 @@ snapshots:
stringify-object: 5.0.0
ts-morph: 26.0.0
tsconfig-paths: 4.2.0
undici: 7.30.0
undici: 7.30.1
validate-npm-package-name: 7.0.2
zod: 4.6.7
transitivePeerDependencies:
@@ -14474,7 +14483,7 @@ snapshots:
undici-types@8.9.0: {}
undici@7.30.0: {}
undici@7.30.1: {}
undici@8.12.3: {}
pnpm-workspace.yaml
+9 -5
View File
@@ -30,7 +30,9 @@ overrides:
# for.
"@hono/node-server@<1.19.15": "^1.19.15"
"picomatch@<4.0.4": "^4.0.4"
"body-parser@<2.3.0": "^2.3.0"
# CVE-2026-111181 (HIGH) raised the floor from 2.3.0. The copy arrives
# under express in the MCP SDK, on a production path.
"body-parser@<2.4.0": "^2.4.0"
# CVE-2026-93749 (source-map-js < 1.2.2, HIGH, under postcss and the
# Tailwind build), CVE-2026-104844 (postcss-selector-parser < 7.1.6, under
# shadcn) and GHSA-r4xh-jqrq-34v2 (smol-toml < 1.9.0, under knip). All three
@@ -46,8 +48,9 @@ overrides:
# malformed authorities. It arrives under ajv, including the connector SDK's
# copy, so it sits on a path this app exposes.
# Authority injection through an unvalidated port in serialize, and a
# follow-up fixed in 3.1.8, raised the floor from 3.1.6.
"fast-uri@<3.1.8": "^3.1.8"
# follow-up fixed in 3.1.8, raised the floor from 3.1.6. CVE-2026-110180 and
# CVE-2026-110306 raised it again to 3.1.9.
"fast-uri@<3.1.9": "^3.1.9"
"flatted@<3.4.2": "^3.4.2"
# GHSA-jqcg-44mw-7w3h: IP spoofing through IPv4-mapped addresses. It
# arrives under express in the MCP SDK; the app resolves client IPs itself,
@@ -100,12 +103,13 @@ overrides:
# Development-only copies (test containers, build tooling) that the
# dependency alerts flag: gRPC under the test containers, brace-expansion on
# three major lines, and undici 7 next to the app's own undici 8.
# three major lines, and undici 7 next to the app's own undici 8
# (CVE-2026-109869, CVE-2026-109841 and CVE-2026-109924 raised it to 7.30.1).
"@grpc/grpc-js@>=1.14.0 <1.14.5": "^1.14.5"
"brace-expansion@<1.1.21": "^1.1.21"
"brace-expansion@>=2.0.0 <2.1.7": "^2.1.7"
"brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
"undici@>=7.0.0 <7.29.1": "^7.29.1"
"undici@>=7.0.0 <7.30.1": "^7.30.1"
# GHSA-587h-7wmj-h5pm (HIGH), GHSA-rq7h-c2jc-7f22, GHSA-r825-w8mm-5pxw,
# GHSA-698v-4r3x-3vcv and GHSA-9jrq-w75r-8gcw: dev-server file serving,