From ba3cf300350f6ae255c76db7c0a84f4eccba6ecc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sat, 29 Aug 2026 19:21:00 +0200 Subject: [PATCH] Override flatted, js-yaml and minimatch past their advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - flatted 3.3.3 → 3.4.4: prototype pollution and unbounded recursion in parse(), fixed in 3.4.2 / 3.4.0. - js-yaml 4.1.1 → 4.3.1: quadratic CPU on merge-key chains and !!omap resolution. The override is bounded to >=4.0.0 so a hypothetical 3.x consumer is never dragged onto a new major. - minimatch 3.1.3 → 3.1.5: ReDoS via nested extglobs. The scanner suggested 10.x, but the fix is backported — only <3.1.4 is vulnerable — so the 3.x line stays where its consumers (eslint) expect it. The 5.x, 9.x and 10.x copies in the tree were never affected. The refreshed lockfile also carries brace-expansion 1.1.12 → 1.1.18 transitively, which clears that package's DoS advisories. pnpm audit reports none of these packages afterwards. --- pnpm-lock.yaml | 42 +++++++++++------------------------------- pnpm-workspace.yaml | 7 +++++++ 2 files changed, 18 insertions(+), 31 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 271314a1c..32915255a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,9 @@ overrides: picomatch@<4.0.4: ^4.0.4 body-parser@<2.3.0: ^2.3.0 fast-uri@<3.1.5: ^3.1.5 + flatted@<3.4.2: ^3.4.2 + js-yaml@>=4.0.0 <4.3.1: ^4.3.1 + minimatch@<3.1.4: ^3.1.4 ip-address@<10.3.1: ^10.3.1 sharp@<0.35.0: ^0.35.3 pdfjs-dist@>=5.6.83 <6.2.108: 6.2.108 @@ -3696,9 +3699,6 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} - brace-expansion@1.1.18: resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} @@ -4554,8 +4554,8 @@ packages: resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==} engines: {node: '>=16'} - flatted@3.3.3: - resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==} + flatted@3.4.4: + resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==} for-each@0.3.5: resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==} @@ -5093,10 +5093,6 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} - hasBin: true - js-yaml@4.3.1: resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true @@ -5458,9 +5454,6 @@ packages: resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.3: - resolution: {integrity: sha512-M2GCs7Vk83NxkUyQV1bkABc4yxgz9kILhHImZiBPAZ9ybuvCb0/H7lEl5XvIg3g+9d4eNotkZA5IWwYl0tibaA==} - minimatch@3.1.5: resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} @@ -7818,7 +7811,7 @@ snapshots: dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3(supports-color@7.2.0) - minimatch: 3.1.3 + minimatch: 3.1.5 transitivePeerDependencies: - supports-color @@ -7838,8 +7831,8 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 - minimatch: 3.1.3 + js-yaml: 4.3.1 + minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -10633,11 +10626,6 @@ snapshots: bowser@2.14.1: {} - brace-expansion@1.1.12: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 @@ -11453,7 +11441,7 @@ snapshots: is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 lodash.merge: 4.6.2 - minimatch: 3.1.3 + minimatch: 3.1.5 natural-compare: 1.4.0 optionator: 0.9.4 optionalDependencies: @@ -11698,10 +11686,10 @@ snapshots: flat-cache@4.0.1: dependencies: - flatted: 3.3.3 + flatted: 3.4.4 keyv: 4.5.4 - flatted@3.3.3: {} + flatted@3.4.4: {} for-each@0.3.5: dependencies: @@ -12187,10 +12175,6 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.1.1: - dependencies: - argparse: 2.0.1 - js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -12509,10 +12493,6 @@ snapshots: dependencies: brace-expansion: 5.0.9 - minimatch@3.1.3: - dependencies: - brace-expansion: 1.1.12 - minimatch@3.1.5: dependencies: brace-expansion: 1.1.18 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 24652c777..e25a0b26e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,6 +7,13 @@ overrides: "picomatch@<4.0.4": "^4.0.4" "body-parser@<2.3.0": "^2.3.0" "fast-uri@<3.1.5": "^3.1.5" + "flatted@<3.4.2": "^3.4.2" + # The advisory covers 4.x only; the bound keeps a hypothetical 3.x consumer + # off a major it never asked for. + "js-yaml@>=4.0.0 <4.3.1": "^4.3.1" + # The scanner suggests 10.x (latest), but the ReDoS fix is backported: only + # <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it. + "minimatch@<3.1.4": "^3.1.4" # Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as # 10.0.0.1 rather than being rejected. That is the exact alt-notation class # `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's