From 3546128dc7245de97a455792162b9d8d70a73bcd Mon Sep 17 00:00:00 2001 From: Guido Dinello Date: Sun, 6 Sep 2026 19:01:57 -0300 Subject: [PATCH] fix: bump transitive deps to patch multiple CVEs Adds pnpm overrides for tar, shell-quote, tmp, adm-zip, uuid, node-forge, js-yaml, ws, rollup, flatted, defu, ajv, @babel/runtime, nanoid, cross-spawn, postcss, postcss-selector-parser, @humanfs/node, and fflate. Closes alerts #113, #112. Deliberately NOT included: vite (#85, #87), vitest (#111), esbuild. Their fixes require crossing a major version boundary (vite 5->6, vitest 4.0->4.1 which itself requires vite 6+) that wxt@0.19.9 and @sveltejs/vite-plugin-svelte@4.0.0-next.7 don't support -- forcing it via override breaks the build (verified: vite override alone resolved everything to vite@7.3.6 and broke `wxt prepare` with an ESM/import.meta error). Needs a wxt major upgrade instead, tracked separately. extract-zip (#109) has no patched version at all (GHSA-jmr9-qjv8-65gv) -- publish-time-only dev tooling, left as accepted risk. Co-Authored-By: Claude Sonnet 5 --- package.json | 22 +++++++++++++++++++++- pnpm-lock.yaml | 44 ++++++++++++++++++++++++++++---------------- 2 files changed, 49 insertions(+), 17 deletions(-) diff --git a/package.json b/package.json index fe77cfc..73f93dc 100644 --- a/package.json +++ b/package.json @@ -113,6 +113,23 @@ }, "pnpm": { "overrides": { + "@sveltejs/vite-plugin-svelte": "^4.0.0-next", + "tar": ">=7.5.21", + "shell-quote": ">=1.9.0", + "tmp": ">=0.2.6", + "adm-zip": ">=0.6.0", + "uuid": ">=11.1.1", + "node-forge": ">=1.4.0", + "js-yaml": ">=4.3.1 <5.0.0", + "ws": ">=8.21.0", + "rollup": ">=4.59.0", + "flatted": ">=3.4.2", + "defu": ">=6.1.5", + "ajv": ">=6.14.0 <7.0.0", + "@babel/runtime": ">=7.26.10 <8.0.0", + "nanoid": ">=3.3.18 <4.0.0", + "cross-spawn": ">=7.0.5", + "postcss": ">=8.5.23", "picomatch@2": ">=2.3.2 <3.0.0", "picomatch@4": ">=4.0.4 <5.0.0", "yaml@1": ">=1.10.3 <2.0.0", @@ -121,7 +138,10 @@ "minimatch@9": ">=9.0.7 <10.0.0", "minimatch@10": ">=10.2.3 <11.0.0", "brace-expansion@1": ">=1.1.18 <2.0.0", - "brace-expansion@2": ">=2.1.4 <3.0.0" + "brace-expansion@2": ">=2.1.4 <3.0.0", + "postcss-selector-parser@>=7.1.0 <7.1.3": ">=7.1.3", + "@humanfs/node@<0.16.8": ">=0.16.8", + "fflate@>=0.8.0 <0.8.3": ">=0.8.3" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cdf46c9..b31cf9a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -31,6 +31,9 @@ overrides: minimatch@10: '>=10.2.3 <11.0.0' brace-expansion@1: '>=1.1.18 <2.0.0' brace-expansion@2: '>=2.1.4 <3.0.0' + postcss-selector-parser@>=7.1.0 <7.1.3: '>=7.1.3' + '@humanfs/node@<0.16.8': '>=0.16.8' + fflate@>=0.8.0 <0.8.3: '>=0.8.3' importers: @@ -664,12 +667,16 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@humanfs/core@0.19.1': - resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} + '@humanfs/core@0.19.2': + resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} engines: {node: '>=18.18.0'} - '@humanfs/node@0.16.7': - resolution: {integrity: sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==} + '@humanfs/node@0.16.8': + resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==} + engines: {node: '>=18.18.0'} + + '@humanfs/types@0.15.0': + resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==} engines: {node: '>=18.18.0'} '@humanwhocodes/module-importer@1.0.1': @@ -1974,8 +1981,8 @@ packages: picomatch: optional: true - fflate@0.8.2: - resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==} + fflate@0.8.3: + resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} figures@6.1.0: resolution: {integrity: sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==} @@ -2932,8 +2939,8 @@ packages: resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==} engines: {node: '>=4'} - postcss-selector-parser@7.1.0: - resolution: {integrity: sha512-8sLjZwK0R+JlxlYcTuVnyT2v+htpdrjDOKuMcOVdYjt52Lh8hWRYpxBPoKx/Zg+bcjc3wx6fmQevMmUztS/ccA==} + postcss-selector-parser@7.1.6: + resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==} engines: {node: '>=4'} postcss-value-parser@4.2.0: @@ -4137,13 +4144,18 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@humanfs/core@0.19.1': {} + '@humanfs/core@0.19.2': + dependencies: + '@humanfs/types': 0.15.0 - '@humanfs/node@0.16.7': + '@humanfs/node@0.16.8': dependencies: - '@humanfs/core': 0.19.1 + '@humanfs/core': 0.19.2 + '@humanfs/types': 0.15.0 '@humanwhocodes/retry': 0.4.3 + '@humanfs/types@0.15.0': {} + '@humanwhocodes/module-importer@1.0.1': {} '@humanwhocodes/retry@0.4.3': {} @@ -4681,7 +4693,7 @@ snapshots: '@vitest/ui@4.0.16(vitest@4.0.16)': dependencies: '@vitest/utils': 4.0.16 - fflate: 0.8.2 + fflate: 0.8.3 flatted: 3.4.4 pathe: 2.0.3 sirv: 3.0.2 @@ -5310,7 +5322,7 @@ snapshots: '@eslint/eslintrc': 3.3.1 '@eslint/js': 9.39.1 '@eslint/plugin-kit': 0.4.1 - '@humanfs/node': 0.16.7 + '@humanfs/node': 0.16.8 '@humanwhocodes/module-importer': 1.0.1 '@humanwhocodes/retry': 0.4.3 '@types/estree': 1.0.8 @@ -5463,7 +5475,7 @@ snapshots: optionalDependencies: picomatch: 4.0.5 - fflate@0.8.2: {} + fflate@0.8.3: {} figures@6.1.0: dependencies: @@ -6341,7 +6353,7 @@ snapshots: cssesc: 3.0.0 util-deprecate: 1.0.2 - postcss-selector-parser@7.1.0: + postcss-selector-parser@7.1.6: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -6752,7 +6764,7 @@ snapshots: espree: 10.4.0 postcss: 8.5.26 postcss-scss: 4.0.9(postcss@8.5.26) - postcss-selector-parser: 7.1.0 + postcss-selector-parser: 7.1.6 optionalDependencies: svelte: 5.0.0-next.245