From 81178e2768d67612f4d3139f8c812c8788bde809 Mon Sep 17 00:00:00 2001 From: Anto Date: Tue, 22 Sep 2026 13:21:47 +0200 Subject: [PATCH 1/3] fix(deps): cierra 19 de 20 alertas y endurece la cuarentena Vulnerabilidades: 20 -> 1 ------------------------- hono@<4.12.34 -> ^4.12.34 7 avisos: ReDoS en el middleware CORS, fuga de SSR entre peticiones en memo(), DoS en el middleware de idioma... (rainbowkit > wagmi > porto) undici@>=7.0.0 <7.29.0 -> ^7.29.0 5 avisos, uno HIGH (fuga de info entre usuarios). Dev, via jsdom. react-router-dom ^7.18.1 -> ^7.18.3 HIGH: bypass de CSRF en modo RSC permite ejecutar actions nanoid@<3.3.18 -> ^3.3.18 HIGH: los generadores personalizados pueden entrar en bucle infinito brace-expansion 4.x/5.x -> ^5.0.9 HIGH: DoS arrays intermedios postcss@<8.5.23 -> ^8.5.23 parche incompleto de GHSA-6g55 uuid@<11.1.1 -> ^11.1.1 bounds check en v3/v5/v6 vitest 4.1.10 -> ^4.1.11 path traversal en el mocker Todos los overrides se quedan dentro del major del propio parche, para no colar un cambio de API por la puerta de atras. Queda 1 sin arreglo posible: decode-uri-component (moderate, DoS por decodificacion exponencial). El aviso pide >=0.4.3, version que no existe; el unico parche es 0.5.0 y es ESM pura. query-string@7.1.3 --quien la usa, via @walletconnect/utils-- la carga con require(), asi que recibe el namespace del modulo en vez de la funcion y revienta con "decodeComponent is not a function" al parsear cualquier query string. Se intento y se revertio. Importante: el build de vite y los 64 tests pasan igualmente con el override puesto; el fallo solo aparece al ejecutar query-string. Queda documentado en pnpm-workspace.yaml. Se verificaron a mano los dos saltos de varios majors: uuid 8.3.2 -> 11.1.1 carga y genera v4() desde @metamask/utils, y query-string sigue parseando bien tras revertir decode-uri-component. Cuarentena ---------- Se anade minimumReleaseAgeIgnoreMissingTime: false. El fichero ya explicaba que pnpm <11.18 aborta con ERR_PNPM_MISSING_TIME por pedir el metadata abreviado; esto cubre el otro lado del problema, que es que pnpm se salte la comprobacion con un simple WARN cuando el campo "time" no esta. Verificacion ------------ 64/64 tests, typecheck limpio, build OK. Comprobados contra el registry los 718 paquetes del lockfile: los 718 tienen 7 dias o mas, 0 violaciones. `pnpm lint` falla con 25 problemas, pero ya fallaba en main con los mismos: son reglas de react-hooks sobre codigo existente, ajenas a este cambio. Co-Authored-By: Claude Opus 5 --- package.json | 4 +- pnpm-lock.yaml | 180 ++++++++++++++++++++++---------------------- pnpm-workspace.yaml | 30 ++++++++ 3 files changed, 121 insertions(+), 93 deletions(-) diff --git a/package.json b/package.json index 6af877c..8791bed 100644 --- a/package.json +++ b/package.json @@ -21,7 +21,7 @@ "lucide-react": "^1.26.0", "react": "^19.2.8", "react-dom": "^19.2.8", - "react-router-dom": "^7.18.1", + "react-router-dom": "^7.18.3", "tailwindcss": "^4.3.3", "viem": "^2.55.8", "wagmi": "^2.19.5" @@ -45,6 +45,6 @@ "typescript": "~6.0.3", "typescript-eslint": "^8.65.0", "vite": "^8.1.5", - "vitest": "^4.1.10" + "vitest": "^4.1.11" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a5aff96..3c05358 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,6 +8,12 @@ overrides: qr: 0.5.5 ws@>=8.0.0 <8.21.0: ^8.21.1 axios: ^1.18.1 + uuid@<11.1.1: ^11.1.1 + postcss@<8.5.23: ^8.5.23 + nanoid@<3.3.18: ^3.3.18 + undici@>=7.0.0 <7.29.0: ^7.29.0 + hono@<4.12.34: ^4.12.34 + brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 importers: @@ -32,8 +38,8 @@ importers: specifier: ^19.2.8 version: 19.2.8(react@19.2.8) react-router-dom: - specifier: ^7.18.1 - version: 7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + specifier: ^7.18.3 + version: 7.18.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8) tailwindcss: specifier: ^4.3.3 version: 4.3.3 @@ -90,8 +96,8 @@ importers: specifier: ^8.1.5 version: 8.1.5(@types/node@25.9.5)(jiti@2.7.0) vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@25.9.5)(jsdom@29.1.1(@noble/hashes@1.8.0))(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@25.9.5)(jsdom@29.1.1(@noble/hashes@1.8.0))(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)) packages: @@ -1330,11 +1336,11 @@ packages: babel-plugin-react-compiler: optional: true - '@vitest/expect@4.1.10': - resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==} + '@vitest/expect@4.1.11': + resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==} - '@vitest/mocker@4.1.10': - resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} + '@vitest/mocker@4.1.11': + resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==} peerDependencies: msw: ^2.4.9 vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -1344,20 +1350,20 @@ packages: vite: optional: true - '@vitest/pretty-format@4.1.10': - resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==} + '@vitest/pretty-format@4.1.11': + resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==} - '@vitest/runner@4.1.10': - resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==} + '@vitest/runner@4.1.11': + resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==} - '@vitest/snapshot@4.1.10': - resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==} + '@vitest/snapshot@4.1.11': + resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==} - '@vitest/spy@4.1.10': - resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==} + '@vitest/spy@4.1.11': + resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==} - '@vitest/utils@4.1.10': - resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==} + '@vitest/utils@4.1.11': + resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==} '@wagmi/connectors@6.2.0': resolution: {integrity: sha512-2NfkbqhNWdjfibb4abRMrn7u6rPjEGolMfApXss6HCDVt9AW2oVC6k8Q5FouzpJezElxLJSagWz9FW1zaRlanA==} @@ -1615,8 +1621,8 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} browserslist@4.28.7: @@ -2157,8 +2163,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.32: - resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==} + hono@4.13.8: + resolution: {integrity: sha512-/Gng7NfoykZl2pjukW5Z6+8Yxm3BPRf86GTbQnt0SbySkvax4fyL4H3HhY1cCpBGmiW9XDRFzRV+CXK2W8QudQ==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -2569,8 +2575,8 @@ packages: multiformats@9.9.0: resolution: {integrity: sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.19: + resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -2772,8 +2778,8 @@ packages: resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==} engines: {node: '>= 0.4'} - postcss@8.5.22: - resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==} + postcss@8.5.28: + resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==} engines: {node: ^10 || ^12 || >=14} preact@10.24.2: @@ -2866,15 +2872,15 @@ packages: '@types/react': optional: true - react-router-dom@7.18.1: - resolution: {integrity: sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==} + react-router-dom@7.18.3: + resolution: {integrity: sha512-ytVbyBBM7vMfRCam25r0WMhSVSom909A8p+8m0/f1w853dz/xfFu6etAT2SEbVoSnI+ZoPRDqIsQXVT89gp7kg==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' react-dom: '>=18' - react-router@7.18.1: - resolution: {integrity: sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==} + react-router@7.18.3: + resolution: {integrity: sha512-gyXgtdr5uACJ5b1Q4udzjVV+tb/rlHIMJKuJ0e89R4Kzgz47z/rgP0dIKxktqIEUhDHluGTPJJH/wRha7CyqsA==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' @@ -3157,8 +3163,8 @@ packages: undici-types@7.28.0: resolution: {integrity: sha512-LJAfY+2w6HGeT8d8J1wNQsUGUEGio6NWWpwdwurQe4f6oojzCFuGLizl1KSve4irsTxyLly1QhEeE6iapdaIvQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.1: + resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} unstorage@1.17.5: @@ -3272,14 +3278,8 @@ packages: util@0.12.5: resolution: {integrity: sha512-kZf/K6hEIrWHI6XqOFUiiMa+79wE/D8Q+NCNAWclkyg3b4d2k7s0QGepNjiABc+aR3N1PAyHL7p6UcLY6LmrnA==} - uuid@8.3.2: - resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). - hasBin: true - - uuid@9.0.1: - resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true valtio@1.13.2: @@ -3353,20 +3353,20 @@ packages: yaml: optional: true - vitest@4.1.10: - resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==} + vitest@4.1.11: + resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.10 - '@vitest/browser-preview': 4.1.10 - '@vitest/browser-webdriverio': 4.1.10 - '@vitest/coverage-istanbul': 4.1.10 - '@vitest/coverage-v8': 4.1.10 - '@vitest/ui': 4.1.10 + '@vitest/browser-playwright': 4.1.11 + '@vitest/browser-preview': 4.1.11 + '@vitest/browser-webdriverio': 4.1.11 + '@vitest/coverage-istanbul': 4.1.11 + '@vitest/coverage-v8': 4.1.11 + '@vitest/ui': 4.1.11 happy-dom: '*' jsdom: '*' vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -4062,7 +4062,7 @@ snapshots: readable-stream: 3.6.2 socket.io-client: 4.8.3(bufferutil@4.1.0)(utf-8-validate@5.0.10) utf-8-validate: 5.0.10 - uuid: 8.3.2 + uuid: 11.1.1 transitivePeerDependencies: - supports-color @@ -4091,7 +4091,7 @@ snapshots: socket.io-client: 4.8.3(bufferutil@4.1.0)(utf-8-validate@5.0.10) tslib: 2.8.1 util: 0.12.5 - uuid: 8.3.2 + uuid: 11.1.1 transitivePeerDependencies: - bufferutil - encoding @@ -4112,7 +4112,7 @@ snapshots: lodash: 4.18.1 pony-cause: 2.1.11 semver: 7.8.5 - uuid: 9.0.1 + uuid: 11.1.1 transitivePeerDependencies: - supports-color @@ -4136,7 +4136,7 @@ snapshots: debug: 4.4.3 pony-cause: 2.1.11 semver: 7.8.5 - uuid: 9.0.1 + uuid: 11.1.1 transitivePeerDependencies: - supports-color @@ -4150,7 +4150,7 @@ snapshots: debug: 4.4.3 pony-cause: 2.1.11 semver: 7.8.5 - uuid: 9.0.1 + uuid: 11.1.1 transitivePeerDependencies: - supports-color @@ -5299,44 +5299,44 @@ snapshots: '@rolldown/pluginutils': 1.0.1 vite: 8.1.5(@types/node@25.9.5)(jiti@2.7.0) - '@vitest/expect@4.1.10': + '@vitest/expect@4.1.11': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.10(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0))': + '@vitest/mocker@4.1.11(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0))': dependencies: - '@vitest/spy': 4.1.10 + '@vitest/spy': 4.1.11 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: vite: 8.1.5(@types/node@25.9.5)(jiti@2.7.0) - '@vitest/pretty-format@4.1.10': + '@vitest/pretty-format@4.1.11': dependencies: tinyrainbow: 3.1.0 - '@vitest/runner@4.1.10': + '@vitest/runner@4.1.11': dependencies: - '@vitest/utils': 4.1.10 + '@vitest/utils': 4.1.11 pathe: 2.0.3 - '@vitest/snapshot@4.1.10': + '@vitest/snapshot@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/pretty-format': 4.1.11 + '@vitest/utils': 4.1.11 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.10': {} + '@vitest/spy@4.1.11': {} - '@vitest/utils@4.1.10': + '@vitest/utils@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 + '@vitest/pretty-format': 4.1.11 convert-source-map: 2.0.0 tinyrainbow: 3.1.0 @@ -6074,7 +6074,7 @@ snapshots: bowser@2.14.1: {} - brace-expansion@5.0.8: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -6608,7 +6608,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.32: {} + hono@4.13.8: {} html-encoding-sniffer@6.0.0(@noble/hashes@1.8.0): dependencies: @@ -6722,7 +6722,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.2 - undici: 7.28.0 + undici: 7.29.1 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -6933,7 +6933,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.12 mipd@0.0.7(typescript@6.0.3): optionalDependencies: @@ -6947,7 +6947,7 @@ snapshots: multiformats@9.9.0: {} - nanoid@3.3.16: {} + nanoid@3.3.19: {} natural-compare@1.4.0: {} @@ -7141,7 +7141,7 @@ snapshots: porto@0.2.35(@tanstack/react-query@5.101.4(react@19.2.8))(@types/react@19.2.17)(@wagmi/core@2.22.1(@tanstack/query-core@5.101.4)(@types/react@19.2.17)(react@19.2.8)(typescript@6.0.3)(use-sync-external-store@1.4.0(react@19.2.8))(viem@2.55.8(bufferutil@4.1.0)(typescript@6.0.3)(utf-8-validate@5.0.10)(zod@3.25.76)))(react@19.2.8)(typescript@6.0.3)(use-sync-external-store@1.4.0(react@19.2.8))(viem@2.55.8(bufferutil@4.1.0)(typescript@6.0.3)(utf-8-validate@5.0.10)(zod@3.25.76))(wagmi@2.19.5(@tanstack/query-core@5.101.4)(@tanstack/react-query@5.101.4(react@19.2.8))(@types/react@19.2.17)(bufferutil@4.1.0)(debug@4.4.3)(react@19.2.8)(typescript@6.0.3)(utf-8-validate@5.0.10)(viem@2.55.8(bufferutil@4.1.0)(typescript@6.0.3)(utf-8-validate@5.0.10)(zod@3.25.76))(zod@3.25.76)): dependencies: '@wagmi/core': 2.22.1(@tanstack/query-core@5.101.4)(@types/react@19.2.17)(react@19.2.8)(typescript@6.0.3)(use-sync-external-store@1.4.0(react@19.2.8))(viem@2.55.8(bufferutil@4.1.0)(typescript@6.0.3)(utf-8-validate@5.0.10)(zod@3.25.76)) - hono: 4.12.32 + hono: 4.13.8 idb-keyval: 6.3.0 mipd: 0.0.7(typescript@6.0.3) ox: 0.9.17(typescript@6.0.3)(zod@4.4.3) @@ -7160,9 +7160,9 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss@8.5.22: + postcss@8.5.28: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.19 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -7241,13 +7241,13 @@ snapshots: optionalDependencies: '@types/react': 19.2.17 - react-router-dom@7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + react-router-dom@7.18.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: react: 19.2.8 react-dom: 19.2.8(react@19.2.8) - react-router: 7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + react-router: 7.18.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8) - react-router@7.18.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + react-router@7.18.3(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: cookie: 1.1.1 react: 19.2.8 @@ -7532,7 +7532,7 @@ snapshots: undici-types@7.28.0: {} - undici@7.28.0: {} + undici@7.29.1: {} unstorage@1.17.5(idb-keyval@6.3.0): dependencies: @@ -7594,9 +7594,7 @@ snapshots: is-typed-array: 1.1.15 which-typed-array: 1.1.22 - uuid@8.3.2: {} - - uuid@9.0.1: {} + uuid@11.1.1: {} valtio@1.13.2(@types/react@19.2.17)(react@19.2.8): dependencies: @@ -7662,7 +7660,7 @@ snapshots: dependencies: lightningcss: 1.33.0 picomatch: 4.0.5 - postcss: 8.5.22 + postcss: 8.5.28 rolldown: 1.1.5 tinyglobby: 0.2.17 optionalDependencies: @@ -7670,15 +7668,15 @@ snapshots: fsevents: 2.3.3 jiti: 2.7.0 - vitest@4.1.10(@types/node@25.9.5)(jsdom@29.1.1(@noble/hashes@1.8.0))(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)): + vitest@4.1.11(@types/node@25.9.5)(jsdom@29.1.1(@noble/hashes@1.8.0))(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)): dependencies: - '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)) - '@vitest/pretty-format': 4.1.10 - '@vitest/runner': 4.1.10 - '@vitest/snapshot': 4.1.10 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/expect': 4.1.11 + '@vitest/mocker': 4.1.11(vite@8.1.5(@types/node@25.9.5)(jiti@2.7.0)) + '@vitest/pretty-format': 4.1.11 + '@vitest/runner': 4.1.11 + '@vitest/snapshot': 4.1.11 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 es-module-lexer: 2.3.1 expect-type: 1.4.0 magic-string: 0.30.21 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c22def8..dd5cff4 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,6 +12,10 @@ # metadata, which omits the `time` field this filter reads. minimumReleaseAge: 10080 +# Si pese a todo a un paquete le falta el campo "time", fallar en vez de +# saltarse la comprobacion en silencio con un WARN. +minimumReleaseAgeIgnoreMissingTime: false + # Pin paulmillr's `qr` to 0.5.5. Newer versions (0.6.0 at time of writing) # reject `border=0`, which is what RainbowKit's `cuer` dependency passes when # rendering the WalletConnect QR. Result: "Uncaught Error: invalid border=0" @@ -28,6 +32,32 @@ overrides: # prototype pollution, runaway recursion in formDataToJSON). Reaches us # through @coinbase/cdp-sdk. axios: ^1.18.1 + # Bounds check ausente en uuid v3/v5/v6. Llega via + # rainbowkit > wagmi > @gemini-wallet/core > @metamask/utils. + uuid@<11.1.1: ^11.1.1 + # PostCSS: parche incompleto de GHSA-6g55-p6wh-862q, y nanoid: los + # generadores personalizados pueden entrar en bucle. Ambos via vite. + postcss@<8.5.23: ^8.5.23 + nanoid@<3.3.18: ^3.3.18 + # Cinco avisos contra undici 7.x, uno de ellos high (fuga de informacion + # entre usuarios). Solo dev: llega via jsdom. + undici@>=7.0.0 <7.29.0: ^7.29.0 + # Siete avisos contra hono <4.12.34: ReDoS en el middleware CORS, fuga de + # SSR entre peticiones en memo(), DoS en el middleware de idioma y mas. + # Llega via rainbowkit > wagmi > porto. + hono@<4.12.34: ^4.12.34 + # DoS por arrays intermedios sin limite. Solo dev, via eslint. + brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 + +# No forzar decode-uri-component. El aviso (moderate, DoS por decodificacion +# exponencial) pide >=0.4.3, version que no existe: el unico parche es 0.5.0, +# y esa es ESM pura ("type": "module"). query-string@7.1.3 --que es quien la +# usa, via @walletconnect/utils-- la carga con require(), asi que en 0.5.0 +# recibe el namespace del modulo en vez de la funcion y revienta con +# "decodeComponent is not a function" al parsear cualquier query string. +# Comprobado: el build de vite y los 64 tests pasan igualmente, el fallo solo +# sale al ejecutar query-string. Revisar cuando walletconnect suba a +# query-string 8+, que ya usa la API nueva. # Explicitly deny build scripts for optional native modules pulled in by ws and # keccak transitives. They all have pure-JS fallbacks and we don't need the From 8c7d200fd97fa67da42c5fbd5bd57f2720f1b1c3 Mon Sep 17 00:00:00 2001 From: Anto Date: Tue, 22 Sep 2026 17:37:55 +0200 Subject: [PATCH 2/3] docs: precisa los comentarios de uuid y decode-uri-component Dos imprecisiones que senalo la review, ninguna funcional: el lockfile no cambia. uuid: el comentario daba una sola ruta (@gemini-wallet/core > @metamask/utils) cuando el selector alcanza cinco dependientes: @metamask/sdk y @metamask/sdk-communication-layer, que declaran ^8.3.2, y @metamask/utils 8.5.0 / 9.3.0 / 11.11.0, que declaran ^9.0.1 y entran por tres caminos distintos (@metamask/rpc-errors > @gemini-wallet/core, @coinbase/wallet-sdk y @metamask/providers). Comprobado con `pnpm why uuid`. Importa para saber que mirar si algo se rompe. decode-uri-component: se anade el aviso, GHSA-vcc3-ghjq-m6fr (CVE-2026-45822), con la advertencia de que pnpm audit dice "patched >=0.4.3" y esa version no existe; el GHSA lista 0.5.0 como parche real. Y se aclara que lo instalado es 0.2.2, que es lo que resuelve el ^0.2.2 de query-string: el 0.4.1 que citaba el texto es solo la ultima vulnerable publicada, no lo que hay en el arbol. 64/64 tests y pnpm audit en la moderada documentada. Co-Authored-By: Claude Opus 5 --- pnpm-workspace.yaml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index dd5cff4..4cae558 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -32,8 +32,12 @@ overrides: # prototype pollution, runaway recursion in formDataToJSON). Reaches us # through @coinbase/cdp-sdk. axios: ^1.18.1 - # Bounds check ausente en uuid v3/v5/v6. Llega via - # rainbowkit > wagmi > @gemini-wallet/core > @metamask/utils. + # Bounds check ausente en uuid v3/v5/v6. El selector alcanza 5 dependientes, + # todos bajo rainbowkit > wagmi > @wagmi/connectors: @metamask/sdk y + # @metamask/sdk-communication-layer (declaran ^8.3.2), y @metamask/utils + # 8.5.0 / 9.3.0 / 11.11.0 (declaran ^9.0.1), que entran por tres caminos: + # @metamask/rpc-errors > @gemini-wallet/core, @coinbase/wallet-sdk y + # @metamask/providers. El lockfile queda con una unica copia, 11.1.1. uuid@<11.1.1: ^11.1.1 # PostCSS: parche incompleto de GHSA-6g55-p6wh-862q, y nanoid: los # generadores personalizados pueden entrar en bucle. Ambos via vite. @@ -58,6 +62,14 @@ overrides: # Comprobado: el build de vite y los 64 tests pasan igualmente, el fallo solo # sale al ejecutar query-string. Revisar cuando walletconnect suba a # query-string 8+, que ya usa la API nueva. +# +# Aviso: GHSA-vcc3-ghjq-m6fr (CVE-2026-45822). Ojo al leerlo, porque pnpm audit +# dice "patched >=0.4.3" y esa version no existe: las publicadas son 0.1.0-0.4.1 +# y 0.5.0, y el GHSA lista 0.5.0 como el parche real. +# +# La version instalada hoy es 0.2.2, no 0.4.1: query-string declara ^0.2.2 y es +# lo que resuelve. El 0.4.1 que se cita arriba es solo la ultima vulnerable +# publicada, util para entender el salto, no lo que hay en el lockfile. # Explicitly deny build scripts for optional native modules pulled in by ws and # keccak transitives. They all have pure-JS fallbacks and we don't need the From a025685decffea40771f43e8f648d45b7ad611a6 Mon Sep 17 00:00:00 2001 From: Anto Date: Tue, 22 Sep 2026 17:41:42 +0200 Subject: [PATCH 3/3] docs: cubre las ramas 1.x/2.x de brace-expansion y documenta el fail-closed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Los dos menores que quedaban de la review. El de uuid ya iba en 8c7d200. brace-expansion: el selector solo cubria >=4.0.0 <5.0.9, que es la unica rama presente hoy (5.0.12, via eslint > minimatch@10, dev). Se anaden las ramas 1.x y 2.x, que no estan en el arbol: si mañana entra un glob o un minimatch@3 declarando ^1.1.x o ^2.x, el selector de la 5.x no lo alcanzaria y volveria a colarse una version vulnerable. Cada rango sube dentro de su propio major, asi que no puede colar un cambio de API. La 3.x no lleva entrada porque no aparece en ningun rango vulnerable de los avisos actuales. Como era de esperar, ninguna resolucion cambia: el lockfile solo registra las dos lineas nuevas de overrides. minimumReleaseAgeIgnoreMissingTime: se documenta la contrapartida que senalaba la review. Al ser fail-closed, un registry que sirva metadata recortado sin "time" rompe el install en vez de dejarlo pasar sin comprobar. Con registry.npmjs.org no ocurre porque pnpm se baja el documento completo cuando el abreviado no lo trae, pero si algun dia se instala desde un mirror o un registro privado conviene saber que la solucion es arreglar el mirror, no poner la opcion en `true`. 64/64 tests, typecheck limpio y audit en la moderada documentada. Co-Authored-By: Claude Opus 5 --- pnpm-lock.yaml | 2 ++ pnpm-workspace.yaml | 22 +++++++++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3c05358..615f237 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,8 @@ overrides: nanoid@<3.3.18: ^3.3.18 undici@>=7.0.0 <7.29.0: ^7.29.0 hono@<4.12.34: ^4.12.34 + brace-expansion@<1.1.17: ^1.1.18 + brace-expansion@>=2.0.0 <2.1.4: ^2.1.4 brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 importers: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 4cae558..1a677c3 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,8 +12,16 @@ # metadata, which omits the `time` field this filter reads. minimumReleaseAge: 10080 -# Si pese a todo a un paquete le falta el campo "time", fallar en vez de -# saltarse la comprobacion en silencio con un WARN. +# Si a un paquete le falta el campo "time", fallar en vez de saltarse la +# comprobacion en silencio con un WARN (que es el default, `true`). +# +# Contrapartida asumida: esto es fail-closed, asi que un registry que sirva +# metadata recortado sin "time" rompe el install en vez de dejarlo pasar sin +# comprobar. Con registry.npmjs.org no ocurre, porque pnpm se descarga el +# documento completo cuando el abreviado no lo trae. Si algun dia se instala +# desde un mirror o un registro privado (Verdaccio, Artifactory) y los installs +# empiezan a fallar por esto, la solucion es arreglar el mirror para que sirva +# "time", no poner esta opcion en `true`. minimumReleaseAgeIgnoreMissingTime: false # Pin paulmillr's `qr` to 0.5.5. Newer versions (0.6.0 at time of writing) @@ -50,7 +58,15 @@ overrides: # SSR entre peticiones en memo(), DoS en el middleware de idioma y mas. # Llega via rainbowkit > wagmi > porto. hono@<4.12.34: ^4.12.34 - # DoS por arrays intermedios sin limite. Solo dev, via eslint. + # DoS por arrays intermedios sin limite. Hoy solo aplica a la 5.x, que entra + # por eslint > minimatch@10 (dev). Las ramas 1.x y 2.x no estan en el arbol, + # pero se cubren igualmente: si mañana entra un glob o un minimatch@3 que + # declare ^1.1.x o ^2.x, el selector de la 5.x no lo alcanzaria y volveria a + # colarse una version vulnerable. Cada rango sube dentro de su propio major, + # asi que no puede colar un cambio de API. La 3.x no aparece en ningun rango + # vulnerable de los avisos actuales, por eso no lleva entrada. + brace-expansion@<1.1.17: ^1.1.18 + brace-expansion@>=2.0.0 <2.1.4: ^2.1.4 brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 # No forzar decode-uri-component. El aviso (moderate, DoS por decodificacion