mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André Bombeck
f41605efba
`undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were published as high after the last run on the trunk, so this is new information rather than neglect, and both matter here: undici is what backs `safeFetch`, which is the one documented egress boundary and the place the connect-time DNS-rebinding pin lives. The undici advisory is a cross-user information disclosure and a parse-time crash through degenerate private cache directives. `fast-uri` arrives four ways through transitive dependencies and the existing override was pinned one patch short of the fix. The safe-fetch dispatcher suite passes against the new client, which is the part that had to be checked rather than assumed: the pin reaches into undici's connect hook and a client bump is exactly where that could quietly stop being enforced.
30 lines
648 B
YAML
30 lines
648 B
YAML
overrides:
|
|
"dompurify@<=3.4.10": "^3.4.11"
|
|
"postcss@<8.5.10": "^8.5.10"
|
|
"@hono/node-server@<1.19.13": "^1.19.13"
|
|
"hono@<4.12.25": "^4.12.25"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
"fast-uri@<3.1.5": "^3.1.5"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- "@openai/codex-security@0.1.1"
|
|
- undici@8.10.0
|