mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André Bombeck
73362dc0ae
Production: the AWS SDK S3 client and lib-storage 3.1152.0, Prisma (client, adapter-pg, CLI) 7.10.1, TanStack Query 5.104.3 and Virtual 3.14.21, dotenv 18.0.8, jspdf-autotable 5.0.9, lucide-react 1.59.0, nodemailer 10.1.2, pg-boss 12.38.0, React and React DOM 19.3.1 (still exact) and undici 8.12. React 19.3.1 and undici 8.12.2 are security releases. Prisma 7.10.1 stops a nested interactive transaction from leaking its id into a later top-level one. pg-boss moves its schema from 45 to 46; the worker applies the migration on start and the index builds continue in the background. Its list and delete helpers now page and batch, which touches only the queue retirement at boot, and that is idempotent. The retention test pins the installed version, so it moves to 12.38.0 after re-checking every source line it asserts. Development: @axe-core/playwright 4.14.0, Playwright 1.64.1, Vitest and its coverage provider 5.0.5, shadcn 4.22.0. The Stryker runner patch still applies; it touches the runner's own name join, and 5.0.5 changes nothing in how Vitest builds a test's full name. axe-core 4.14 turns on label-content-name-mismatch for the WCAG 2.1 A tag the a11y specs run. The S3 client is held on the same release as lib-storage rather than the newest one its range allows, so the two share one SDK core. Vite gets a floor at 8.1.6 for GHSA-587h-7wmj-h5pm and four sibling advisories against its dev server and bundled launch-editor. It arrives only under Vitest and never reaches the image. The image's separate Prisma CLI install moves with the app tree to 7.10.1, and its dotenv to 18.0.8, which it had trailed by a patch.
144 lines
7.0 KiB
YAML
144 lines
7.0 KiB
YAML
overrides:
|
|
# CVE-2026-84375 (js-yaml < 4.3.2, HIGH), CVE-2026-84363/84364/84365 (hono
|
|
# < 4.13.5, via @hono/node-server under the MCP SDK; GHSA-5r4p-p66f-jhc7 raised the
|
|
# floor to 4.13.11), CVE-2026-45819
|
|
# (baseline-browser-mapping < 2.11.0), GHSA-rgj7-g3m4-5g8c (sharp < 0.35.4,
|
|
# pulled by next). None is a direct dependency; the bounds move the copies
|
|
# the scanner flags and nothing else.
|
|
"js-yaml@<4.3.2": "^4.3.2"
|
|
"hono@<4.13.11": "^4.13.11"
|
|
"baseline-browser-mapping@<2.11.0": "^2.11.0"
|
|
"sharp@<0.35.4": "^0.35.4"
|
|
# GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its
|
|
# markup survives into the output. The copy here is jspdf's optional HTML
|
|
# renderer, which the doctor-report PDF path reaches.
|
|
# A later advisory against 3.4.13 to 3.4.15 raised the floor to 3.4.16.
|
|
"dompurify@<3.4.16": "^3.4.16"
|
|
# CVE-2026-69153. Next declares an exact `postcss@8.4.31`, so nothing except
|
|
# this bound moves it. The build has run on the 8.5 line since the first
|
|
# bump; the fix landed in 8.5.23.
|
|
"postcss@<8.5.23": "^8.5.23"
|
|
"nanoid@<3.3.18": "^3.3.18"
|
|
# GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. Mirrored for
|
|
# /opt/prisma-cli in the Dockerfile, which is where the flagged 1.19.11
|
|
# actually landed: prisma pulls it through @prisma/dev, and that install
|
|
# reads npm `overrides`, not this file. The bound stays on the 1.x line
|
|
# because the advisory is fixed there too and 2.x is a major nothing asked
|
|
# for.
|
|
"@hono/node-server@<1.19.15": "^1.19.15"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
# CVE-2026-93749 (source-map-js < 1.2.2, HIGH, under postcss and the
|
|
# Tailwind build), CVE-2026-104844 (postcss-selector-parser < 7.1.6, under
|
|
# shadcn) and GHSA-r4xh-jqrq-34v2 (smol-toml < 1.9.0, under knip). All three
|
|
# are quadratic-time parsers reached at build or dev time only.
|
|
"source-map-js@<1.2.2": "^1.2.2"
|
|
"postcss-selector-parser@<7.1.6": "^7.1.6"
|
|
"smol-toml@<1.9.0": "^1.9.0"
|
|
# Array-limit bypass through bracket-key comma parsing, and a denial of
|
|
# service through an attacker-controlled isBuffer. 6.16.0 covers both.
|
|
"qs@<6.16.0": "^6.16.0"
|
|
# GHSA-jqff-g426-hqxp and three siblings: host confusion and request
|
|
# forgery through percent-encoded schemes, skipped IDN canonicalisation and
|
|
# malformed authorities. It arrives under ajv, including the connector SDK's
|
|
# copy, so it sits on a path this app exposes.
|
|
# Authority injection through an unvalidated port in serialize, and a
|
|
# follow-up fixed in 3.1.8, raised the floor from 3.1.6.
|
|
"fast-uri@<3.1.8": "^3.1.8"
|
|
"flatted@<3.4.2": "^3.4.2"
|
|
# GHSA-jqcg-44mw-7w3h: IP spoofing through IPv4-mapped addresses. It
|
|
# arrives under express in the MCP SDK; the app resolves client IPs itself,
|
|
# but the copy sits on a production path.
|
|
"proxy-addr@<2.0.8": "^2.0.8"
|
|
# GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
|
|
# Reached only through prisma's MySQL driver, which this app never opens;
|
|
# pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the
|
|
# Dockerfile.
|
|
"mysql2@<3.22.0": "^3.22.0"
|
|
# The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
|
|
# <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
|
|
"minimatch@<3.1.4": "^3.1.4"
|
|
# Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
|
|
# 10.0.0.1 rather than being rejected. That is the exact alt-notation class
|
|
# `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
|
|
# rate limiter where nothing of ours screens it.
|
|
# Later advisories up to 10.7.0 raised the floor from 10.3.1 to 10.7.1.
|
|
"ip-address@<10.7.1": "^10.7.1"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
# A crafted PDF could run arbitrary JavaScript through the renderer. Our own
|
|
# copy is pinned past it in `devDependencies`, but a second copy arrives
|
|
# transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
|
|
# the store into the standalone image — so an unused transitive copy is still
|
|
# a copy in the runtime image. The range is bounded on both ends deliberately:
|
|
# `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
|
|
# text-extraction path, so it must not be dragged onto a new major.
|
|
"pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
|
|
# Deeply nested input drives DeepmergeTS into unbounded recursion until the
|
|
# stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
|
|
# 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
|
|
# override is the only way through. It runs on the config-loading and CLI
|
|
# path, not under a request, but a red audit blocks the whole release train.
|
|
"deepmerge-ts@<8.0.0": "^8.0.0"
|
|
# CVE-2026-59952. The copy arrives through prisma's local dev server, not
|
|
# ours to call. Mirrored for /opt/prisma-cli in the Dockerfile,
|
|
# where the flagged 1.2.0 landed. 1.4.2 is the same major, so no consumer is
|
|
# dragged onto a new one.
|
|
"valibot@<1.4.2": "^1.4.2"
|
|
|
|
# GHSA-p498-v437-472g. eslint's filesystem layer; development-only, but the
|
|
# floor costs nothing and keeps the advisory list at zero so a real one is
|
|
# not lost in the noise.
|
|
"@humanfs/node@<0.16.8": "^0.16.8"
|
|
|
|
# GHSA-g7r4-m6w7-qqqr. Reached through the test tooling, never shipped. The
|
|
# patched line is the same minor, so nothing downstream moves.
|
|
"esbuild@>=0.27.3 <0.28.1": "^0.28.1"
|
|
|
|
# Development-only copies (test containers, build tooling) that the
|
|
# dependency alerts flag: gRPC under the test containers, brace-expansion on
|
|
# three major lines, and undici 7 next to the app's own undici 8.
|
|
"@grpc/grpc-js@>=1.14.0 <1.14.5": "^1.14.5"
|
|
"brace-expansion@<1.1.21": "^1.1.21"
|
|
"brace-expansion@>=2.0.0 <2.1.7": "^2.1.7"
|
|
"brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
|
|
"undici@>=7.0.0 <7.29.1": "^7.29.1"
|
|
|
|
# GHSA-587h-7wmj-h5pm (HIGH), GHSA-rq7h-c2jc-7f22, GHSA-r825-w8mm-5pxw,
|
|
# GHSA-698v-4r3x-3vcv and GHSA-9jrq-w75r-8gcw: dev-server file serving,
|
|
# cross-origin middleware and the bundled launch-editor. Vite arrives only
|
|
# under vitest, never in the image; vitest asks for ^8, so a floor on the
|
|
# same major moves it and nothing else.
|
|
"vite@>=8.0.0 <8.1.6": "^8.1.6"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- undici@8.10.0
|
|
|
|
auditConfig:
|
|
ignoreGhsas:
|
|
# node-forge <=1.4.0, RSA PKCS#1 v1.5 signature verification. It arrives
|
|
# only through @parse/node-apn, which uses it for certificate-based APNs
|
|
# credentials (p12 / PEM certificate). HealthLog authenticates to APNs
|
|
# with a token (.p8 key, APNS_KEY_ID / APNS_TEAM_ID), so that code path
|
|
# never runs. No patched release is published yet (latest is 1.4.0);
|
|
# remove this entry and raise the floor once 1.4.1 is out.
|
|
- GHSA-86w9-cpqp-85rv
|
|
|
|
patchedDependencies:
|
|
"@stryker-mutator/vitest-runner@10.0.0": patches/@stryker-mutator__vitest-runner@10.0.0.patch
|