mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André Bombeck
315ca5e67c
pdfjs-dist 6.1.200 and a transitive 5.6.205 both sit in the affected range of a flaw that lets a crafted PDF run JavaScript inside the renderer. The document vault feeds it every uploaded PDF, so pin the direct dependency to 6.2.108 and add a bounded override so the transitive copy lands there too. The override stops short of pdf-parse's 5.4.296, which predates the flaw and drives the local text-extraction path. The runtime image ships every pdfjs-dist copy in the store, not just the one that gets loaded, so an unused transitive copy still counted. Hoisting in the image picked whichever copy the filesystem listed first, and more than one copy reaches it, so the version named in package.json was not reliably the one the renderer resolved. Carry the resolved version forward from the build stage, select it by name, and fail the build when it is missing rather than leaving another copy in its place.
43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
overrides:
|
|
"dompurify@<=3.4.10": "^3.4.11"
|
|
"postcss@<8.5.10": "^8.5.10"
|
|
"@hono/node-server@<1.19.13": "^1.19.13"
|
|
"hono@<4.12.25": "^4.12.25"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
"fast-uri@<3.1.5": "^3.1.5"
|
|
# Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
|
|
# 10.0.0.1 rather than being rejected. That is the exact alt-notation class
|
|
# `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
|
|
# rate limiter where nothing of ours screens it.
|
|
"ip-address@<10.3.1": "^10.3.1"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
# A crafted PDF could run arbitrary JavaScript through the renderer. Our own
|
|
# copy is pinned past it in `devDependencies`, but a second copy arrives
|
|
# transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
|
|
# the store into the standalone image — so an unused transitive copy is still
|
|
# a copy in the runtime image. The range is bounded on both ends deliberately:
|
|
# `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
|
|
# text-extraction path, so it must not be dragged onto a new major.
|
|
"pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- "@openai/codex-security@0.1.1"
|
|
- undici@8.10.0
|