mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
ba3cf30035
- flatted 3.3.3 → 3.4.4: prototype pollution and unbounded recursion in parse(), fixed in 3.4.2 / 3.4.0. - js-yaml 4.1.1 → 4.3.1: quadratic CPU on merge-key chains and !!omap resolution. The override is bounded to >=4.0.0 so a hypothetical 3.x consumer is never dragged onto a new major. - minimatch 3.1.3 → 3.1.5: ReDoS via nested extglobs. The scanner suggested 10.x, but the fix is backported — only <3.1.4 is vulnerable — so the 3.x line stays where its consumers (eslint) expect it. The 5.x, 9.x and 10.x copies in the tree were never affected. The refreshed lockfile also carries brace-expansion 1.1.12 → 1.1.18 transitively, which clears that package's DoS advisories. pnpm audit reports none of these packages afterwards.
57 lines
2.3 KiB
YAML
57 lines
2.3 KiB
YAML
overrides:
|
|
"dompurify@<=3.4.10": "^3.4.11"
|
|
"postcss@<8.5.10": "^8.5.10"
|
|
"nanoid@<3.3.18": "^3.3.18"
|
|
"@hono/node-server@<1.19.13": "^1.19.13"
|
|
"hono@<4.12.25": "^4.12.25"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
"fast-uri@<3.1.5": "^3.1.5"
|
|
"flatted@<3.4.2": "^3.4.2"
|
|
# The advisory covers 4.x only; the bound keeps a hypothetical 3.x consumer
|
|
# off a major it never asked for.
|
|
"js-yaml@>=4.0.0 <4.3.1": "^4.3.1"
|
|
# The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
|
|
# <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
|
|
"minimatch@<3.1.4": "^3.1.4"
|
|
# Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
|
|
# 10.0.0.1 rather than being rejected. That is the exact alt-notation class
|
|
# `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
|
|
# rate limiter where nothing of ours screens it.
|
|
"ip-address@<10.3.1": "^10.3.1"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
# A crafted PDF could run arbitrary JavaScript through the renderer. Our own
|
|
# copy is pinned past it in `devDependencies`, but a second copy arrives
|
|
# transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
|
|
# the store into the standalone image — so an unused transitive copy is still
|
|
# a copy in the runtime image. The range is bounded on both ends deliberately:
|
|
# `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
|
|
# text-extraction path, so it must not be dragged onto a new major.
|
|
"pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
|
|
# Deeply nested input drives DeepmergeTS into unbounded recursion until the
|
|
# stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
|
|
# 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
|
|
# override is the only way through. It runs on the config-loading and CLI
|
|
# path, not under a request, but a red audit blocks the whole release train.
|
|
"deepmerge-ts@<8.0.0": "^8.0.0"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- "@openai/codex-security@0.1.1"
|
|
- undici@8.10.0
|