mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 13:22:14 +00:00
Marc-André Bombeck
f62cd59789
Three overrides had drifted behind the advisories they were written for, and the scan found the packages at versions the pins were supposed to exclude. dompurify moves from <=3.4.10 to <3.4.13. GHSA-55q2-fjhq-7xh7 is fixed in 3.4.13 and the tree carried 3.4.12. The copy is jspdf's optional HTML renderer, an optionalDependency at ^3.3.1, so the raise stays inside the range jspdf declares. postcss moves from <8.5.10 to <8.5.23 for CVE-2026-69153. next declares an exact postcss@8.4.31, so nothing but this bound moves it; the build has run on the 8.5 line since the first bump and stays there. valibot gets a floor it never had, <1.4.2, for CVE-2026-59952. Two copies arrive and neither is ours to call: an optional peer of @hookform/resolvers, which this app does not use because it validates with zod, and prisma's local dev server. 1.4.2 is the same major, so no consumer is moved onto a new one. @hono/node-server moves from <1.19.13 to <1.19.15 for GHSA-frvp-7c67-39w9. The app tree already resolved 1.19.17, so this changes nothing here; it exists so the bound states the real floor and so the Dockerfile mirror has something correct to match. The floor test in ci-determinism asserted the exact key and replacement string, which meant every legitimate raise failed it while a floor gone stale against a newer advisory passed it unchanged. It now reduces each key to a package name and asserts the pin is at or above the fixed version, with a case proving the comparison can return false.
80 lines
3.7 KiB
YAML
80 lines
3.7 KiB
YAML
overrides:
|
|
# GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its
|
|
# markup survives into the output. The copy here is jspdf's optional HTML
|
|
# renderer, which the doctor-report PDF path reaches.
|
|
"dompurify@<3.4.13": "^3.4.13"
|
|
# CVE-2026-69153. Next declares an exact `postcss@8.4.31`, so nothing except
|
|
# this bound moves it. The build has run on the 8.5 line since the first
|
|
# bump; the fix landed in 8.5.23.
|
|
"postcss@<8.5.23": "^8.5.23"
|
|
"nanoid@<3.3.18": "^3.3.18"
|
|
# GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. Mirrored for
|
|
# /opt/prisma-cli in the Dockerfile, which is where the flagged 1.19.11
|
|
# actually landed: prisma pulls it through @prisma/dev, and that install
|
|
# reads npm `overrides`, not this file. The bound stays on the 1.x line
|
|
# because the advisory is fixed there too and 2.x is a major nothing asked
|
|
# for.
|
|
"@hono/node-server@<1.19.15": "^1.19.15"
|
|
"hono@<4.12.25": "^4.12.25"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
"fast-uri@<3.1.5": "^3.1.5"
|
|
"flatted@<3.4.2": "^3.4.2"
|
|
# The advisory covers 4.x only; the bound keeps a hypothetical 3.x consumer
|
|
# off a major it never asked for.
|
|
"js-yaml@>=4.0.0 <4.3.1": "^4.3.1"
|
|
# GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
|
|
# Reached only through prisma's MySQL driver, which this app never opens;
|
|
# pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the
|
|
# Dockerfile.
|
|
"mysql2@<3.22.0": "^3.22.0"
|
|
# The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
|
|
# <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
|
|
"minimatch@<3.1.4": "^3.1.4"
|
|
# Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
|
|
# 10.0.0.1 rather than being rejected. That is the exact alt-notation class
|
|
# `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
|
|
# rate limiter where nothing of ours screens it.
|
|
"ip-address@<10.3.1": "^10.3.1"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
# A crafted PDF could run arbitrary JavaScript through the renderer. Our own
|
|
# copy is pinned past it in `devDependencies`, but a second copy arrives
|
|
# transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
|
|
# the store into the standalone image — so an unused transitive copy is still
|
|
# a copy in the runtime image. The range is bounded on both ends deliberately:
|
|
# `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
|
|
# text-extraction path, so it must not be dragged onto a new major.
|
|
"pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
|
|
# Deeply nested input drives DeepmergeTS into unbounded recursion until the
|
|
# stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
|
|
# 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
|
|
# override is the only way through. It runs on the config-loading and CLI
|
|
# path, not under a request, but a red audit blocks the whole release train.
|
|
"deepmerge-ts@<8.0.0": "^8.0.0"
|
|
# CVE-2026-59952. Two copies arrive, neither of them ours to call: an
|
|
# optional peer of `@hookform/resolvers` (this app validates with zod) and
|
|
# prisma's local dev server. Mirrored for /opt/prisma-cli in the Dockerfile,
|
|
# where the flagged 1.2.0 landed. 1.4.2 is the same major, so no consumer is
|
|
# dragged onto a new one.
|
|
"valibot@<1.4.2": "^1.4.2"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- "@openai/codex-security@0.1.1"
|
|
- undici@8.10.0
|