tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-11 13:52:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): let the newer hono and js-yaml bounds win

Browse Source 
pnpm-workspace.yaml carried two overrides for the same packages: an older floor (hono < 4.12.25, js-yaml >= 4.0.0 < 4.3.1) and the newer one added for the scanner findings. The older selector won the resolution, so the lockfile kept hono 4.13.3 and js-yaml 4.3.1 and four of the seventeen findings stayed open after v1.38.12. The stale bounds are gone; the lockfile now resolves hono 4.13.7 and js-yaml 4.3.2.
This commit is contained in:
Marc-André Bombeck committed 2026-09-09 21:38:16 +02:00
1 parent d464a3efe4
commit 40b9427259
2 files changed
+17 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pnpm-lock.yaml
Generated
+17 -19
View File
@@ -13,13 +13,11 @@ overrides:
postcss@<8.5.23: ^8.5.23
nanoid@<3.3.18: ^3.3.18
'@hono/node-server@<1.19.15': ^1.19.15
hono@<4.12.25: ^4.12.25
picomatch@<4.0.4: ^4.0.4
body-parser@<2.3.0: ^2.3.0
qs@<6.16.0: ^6.16.0
fast-uri@<3.1.6: ^3.1.6
flatted@<3.4.2: ^3.4.2
js-yaml@>=4.0.0 <4.3.1: ^4.3.1
mysql2@<3.22.0: ^3.22.0
minimatch@<3.1.4: ^3.1.4
ip-address@<10.3.1: ^10.3.1
@@ -699,7 +697,7 @@ packages:
resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==}
engines: {node: '>=18.14.1'}
peerDependencies:
hono: ^4.12.25
hono: ^4.13.5
'@hookform/resolvers@5.9.1':
resolution: {integrity: sha512-7b7vsbraJxKgjVSA1Nur9tLwj539WGJUBLA7QNvXnFoT2pM5Z7G+6rlukk4B2/QrTZy6huRtH6wKeESPKuIr6w==}
@@ -4464,8 +4462,8 @@ packages:
hermes-parser@0.25.1:
resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
hono@4.13.3:
resolution: {integrity: sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==}
hono@4.13.7:
resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==}
engines: {node: '>=16.9.0'}
html-escaper@2.0.2:
@@ -4790,8 +4788,8 @@ packages:
js-tokens@4.0.0:
resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
js-yaml@4.3.1:
resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
js-yaml@4.3.2:
resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
hasBin: true
jsesc@3.1.0:
@@ -7411,7 +7409,7 @@ snapshots:
globals: 14.0.0
ignore: 5.3.2
import-fresh: 3.3.1
js-yaml: 4.3.1
js-yaml: 4.3.2
minimatch: 3.1.5
strip-json-comments: 3.1.1
transitivePeerDependencies:
@@ -7464,9 +7462,9 @@ snapshots:
'@hexagon/base64@1.1.28': {}
'@hono/node-server@1.19.17(hono@4.13.3)':
'@hono/node-server@1.19.17(hono@4.13.7)':
dependencies:
hono: 4.13.3
hono: 4.13.7
'@hookform/resolvers@5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.83.0(react@19.2.7))(valibot@1.4.2(typescript@6.0.3))(zod@4.4.3)':
dependencies:
@@ -7677,7 +7675,7 @@ snapshots:
'@modelcontextprotocol/sdk@1.30.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@3.25.76)':
dependencies:
'@hono/node-server': 1.19.17(hono@4.13.3)
'@hono/node-server': 1.19.17(hono@4.13.7)
ajv: 8.20.0
ajv-formats: 3.0.1(ajv@8.20.0)
content-type: 1.0.5
@@ -7687,7 +7685,7 @@ snapshots:
eventsource-parser: 3.1.1
express: 5.2.1(supports-color@7.2.0)
express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0)
hono: 4.13.3
hono: 4.13.7
jose: 6.2.10
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
@@ -7701,7 +7699,7 @@ snapshots:
'@modelcontextprotocol/sdk@1.30.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.4.3)':
dependencies:
'@hono/node-server': 1.19.17(hono@4.13.3)
'@hono/node-server': 1.19.17(hono@4.13.7)
ajv: 8.20.0
ajv-formats: 3.0.1(ajv@8.20.0)
content-type: 1.0.5
@@ -7711,7 +7709,7 @@ snapshots:
eventsource-parser: 3.1.1
express: 5.2.1(supports-color@7.2.0)
express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0)
hono: 4.13.3
hono: 4.13.7
jose: 6.2.10
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
@@ -8245,13 +8243,13 @@ snapshots:
'@electric-sql/pglite': 0.4.1
'@electric-sql/pglite-socket': 0.1.1(@electric-sql/pglite@0.4.1)
'@electric-sql/pglite-tools': 0.3.1(@electric-sql/pglite@0.4.1)
'@hono/node-server': 1.19.17(hono@4.13.3)
'@hono/node-server': 1.19.17(hono@4.13.7)
'@prisma/get-platform': 7.2.0
'@prisma/query-plan-executor': 7.2.0
'@prisma/streams-local': 0.1.2
foreground-child: 3.3.1
get-port-please: 3.2.0
hono: 4.13.3
hono: 4.13.7
http-status-codes: 2.3.0
pathe: 2.0.3
proper-lockfile: 4.1.2
@@ -10239,7 +10237,7 @@ snapshots:
dependencies:
env-paths: 2.2.1
import-fresh: 3.3.1
js-yaml: 4.3.1
js-yaml: 4.3.2
parse-json: 5.2.0
optionalDependencies:
typescript: 6.0.3
@@ -11215,7 +11213,7 @@ snapshots:
dependencies:
hermes-estree: 0.25.1
hono@4.13.3: {}
hono@4.13.7: {}
html-escaper@2.0.2: {}
@@ -11498,7 +11496,7 @@ snapshots:
js-tokens@4.0.0: {}
js-yaml@4.3.1:
js-yaml@4.3.2:
dependencies:
argparse: 2.0.1
pnpm-workspace.yaml
-4
View File
@@ -24,7 +24,6 @@ overrides:
# because the advisory is fixed there too and 2.x is a major nothing asked
# for.
"@hono/node-server@<1.19.15": "^1.19.15"
"hono@<4.12.25": "^4.12.25"
"picomatch@<4.0.4": "^4.0.4"
"body-parser@<2.3.0": "^2.3.0"
# Array-limit bypass through bracket-key comma parsing, and a denial of
@@ -36,9 +35,6 @@ overrides:
# copy, so it sits on a path this app exposes.
"fast-uri@<3.1.6": "^3.1.6"
"flatted@<3.4.2": "^3.4.2"
# The advisory covers 4.x only; the bound keeps a hypothetical 3.x consumer
# off a major it never asked for.
"js-yaml@>=4.0.0 <4.3.1": "^4.3.1"
# GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
# Reached only through prisma's MySQL driver, which this app never opens;
# pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the