From 7a7252eb76e4a17c0b84b93db788bcdf9ed0bfea Mon Sep 17 00:00:00 2001 From: Jessica He Date: Fri, 4 Sep 2026 14:33:10 -0400 Subject: [PATCH 1/2] chore(deps): bump deps for 1.9.9 CVEs Signed-off-by: Jessica He --- dynamic-plugins/yarn.lock | 24 ++++++++++---------- packages/backend/package.json | 2 +- yarn.lock | 41 +++++++++++++++-------------------- 3 files changed, 30 insertions(+), 37 deletions(-) diff --git a/dynamic-plugins/yarn.lock b/dynamic-plugins/yarn.lock index 7f1908036a..4ed64a595d 100644 --- a/dynamic-plugins/yarn.lock +++ b/dynamic-plugins/yarn.lock @@ -22109,9 +22109,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.0.1": - version: 3.1.3 - resolution: "fast-uri@npm:3.1.3" - checksum: 288724ec7170d190c6456824fc50eff8ea5b9636d3ac8183cfa039653babf015a67dcb930c632ca5997a6613ebcc8b8e41283e6fab235d7dcfa909b196594e29 + version: 3.1.7 + resolution: "fast-uri@npm:3.1.7" + checksum: 2095554c1e48b5a772529175dfa8d3c2ca33a1db6c84abe1584f9c4c3337b62d8e4807ed60a806f85bb7635cb7acca6c66c0c642b867efc3ea4e20a0d6c40cbe languageName: node linkType: hard @@ -23300,8 +23300,8 @@ __metadata: linkType: hard "handlebars@npm:^4.7.3, handlebars@npm:^4.7.7": - version: 4.7.8 - resolution: "handlebars@npm:4.7.8" + version: 4.7.9 + resolution: "handlebars@npm:4.7.9" dependencies: minimist: ^1.2.5 neo-async: ^2.6.2 @@ -23313,7 +23313,7 @@ __metadata: optional: true bin: handlebars: bin/handlebars - checksum: 00e68bb5c183fd7b8b63322e6234b5ac8fbb960d712cb3f25587d559c2951d9642df83c04a1172c918c41bcfc81bfbd7a7718bbce93b893e0135fc99edea93ff + checksum: ac39070fc1c3c76a654e4b526383eaf1601976eaa474547b263915b4806977f083600e586ca923709baeed7c82a42640bcc9cc04c37a7efd3fb444f49b8347d6 languageName: node linkType: hard @@ -28161,9 +28161,9 @@ __metadata: linkType: hard "nodemailer@npm:^7.0.7": - version: 7.0.12 - resolution: "nodemailer@npm:7.0.12" - checksum: 8e4f6d67c334c31c644ef9557a7f65cd1397340b84bc5cb2d3373032772a68577c5a11dbd4f227d42f7b4df40daad06a1b1c32e76c57c15b880b0ca468cc9713 + version: 7.0.13 + resolution: "nodemailer@npm:7.0.13" + checksum: 3faf2549a1e7cef03e8a20ee7816fd9012f2de4faa98f185998ecb10a8d97d048f12dc20b4efc1fa82c342ec27407329c74ac9143e8d6135c6f5da05a04f54d6 languageName: node linkType: hard @@ -34320,9 +34320,9 @@ __metadata: linkType: hard "undici@npm:^7.1.1, undici@npm:^7.2.3": - version: 7.28.0 - resolution: "undici@npm:7.28.0" - checksum: 57c77c4ee75e166ef361ad238fcd88816fbc0d058aeadf4c0f689194bd17eb6d63ce25b89bd4f4d65a380ebbde784bf4886ec51acc9f8c826ecab01d8f63aaac + version: 7.29.1 + resolution: "undici@npm:7.29.1" + checksum: 1e78f8920a92e60f1cb1489dac1066424e5afcbd27131638389731c7ad53dbfa6c6f3a77c335f9607cce80a4ca273c38a6d7316f0041ce37a3f51364c6531296 languageName: node linkType: hard diff --git a/packages/backend/package.json b/packages/backend/package.json index c5c1fb26af..4b4f2585bc 100644 --- a/packages/backend/package.json +++ b/packages/backend/package.json @@ -80,7 +80,7 @@ "app-next": "workspace:*", "global-agent": "3.0.0", "jose": "5.10.0", - "undici": "6.27.0", + "undici": "7.29.1", "winston": "3.14.2", "zod": "3.25.76" }, diff --git a/yarn.lock b/yarn.lock index f4c7dead81..fb28d266e1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17540,9 +17540,9 @@ __metadata: linkType: hard "@xmldom/xmldom@npm:^0.8.3": - version: 0.8.13 - resolution: "@xmldom/xmldom@npm:0.8.13" - checksum: b5568a3dee6306c4c6256c94f27d74f904d7cc923607f0dcaa37998e370361ce37a6e99aa55e8e725f07079e619a6f8b3a7de218e76b522ba2b1aca3ada5265c + version: 0.8.15 + resolution: "@xmldom/xmldom@npm:0.8.15" + checksum: efeb17d041ed73adb54c903fe959254a3b2155f820b127dbf0b5390a2b1436143bb34fab58c3f82e58aa910d0c5d4f1e205cd9370d39f098ec1ce8c6daf0424e languageName: node linkType: hard @@ -18747,7 +18747,7 @@ __metadata: jose: 5.10.0 prettier: 3.7.4 typescript: 5.9.3 - undici: 6.27.0 + undici: 7.29.1 winston: 3.14.2 zod: 3.25.76 languageName: unknown @@ -23514,9 +23514,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.0.1": - version: 3.1.3 - resolution: "fast-uri@npm:3.1.3" - checksum: 288724ec7170d190c6456824fc50eff8ea5b9636d3ac8183cfa039653babf015a67dcb930c632ca5997a6613ebcc8b8e41283e6fab235d7dcfa909b196594e29 + version: 3.1.7 + resolution: "fast-uri@npm:3.1.7" + checksum: 2095554c1e48b5a772529175dfa8d3c2ca33a1db6c84abe1584f9c4c3337b62d8e4807ed60a806f85bb7635cb7acca6c66c0c642b867efc3ea4e20a0d6c40cbe languageName: node linkType: hard @@ -23649,9 +23649,9 @@ __metadata: linkType: hard "fflate@npm:^0.8.2": - version: 0.8.2 - resolution: "fflate@npm:0.8.2" - checksum: 29470337b85d3831826758e78f370e15cda3169c5cd4477c9b5eea2402261a74b2975bae816afabe1c15d21d98591e0d30a574f7103aa117bff60756fa3035d4 + version: 0.8.3 + resolution: "fflate@npm:0.8.3" + checksum: a2a417e8fb5128b946cb397ab59a90e089057cba492f2c17a89c4af6ba8568b3da72ed36ef1efe901df7858a20964ce56e84d282e60498be1947fcc6133bc891 languageName: node linkType: hard @@ -24877,8 +24877,8 @@ __metadata: linkType: hard "handlebars@npm:^4.7.3, handlebars@npm:^4.7.7": - version: 4.7.8 - resolution: "handlebars@npm:4.7.8" + version: 4.7.9 + resolution: "handlebars@npm:4.7.9" dependencies: minimist: ^1.2.5 neo-async: ^2.6.2 @@ -24890,7 +24890,7 @@ __metadata: optional: true bin: handlebars: bin/handlebars - checksum: 00e68bb5c183fd7b8b63322e6234b5ac8fbb960d712cb3f25587d559c2951d9642df83c04a1172c918c41bcfc81bfbd7a7718bbce93b893e0135fc99edea93ff + checksum: ac39070fc1c3c76a654e4b526383eaf1601976eaa474547b263915b4806977f083600e586ca923709baeed7c82a42640bcc9cc04c37a7efd3fb444f49b8347d6 languageName: node linkType: hard @@ -37669,17 +37669,10 @@ __metadata: languageName: node linkType: hard -"undici@npm:6.27.0": - version: 6.27.0 - resolution: "undici@npm:6.27.0" - checksum: 3c3c591d9cc70b72ed20ec19fcbab04f184827bcb05241a215f92a081e6e73cab506cd2b334e3beb359304c2e53b6e8722c31327124d9db8122bb06fed7be372 - languageName: node - linkType: hard - -"undici@npm:^7.1.1, undici@npm:^7.13.0, undici@npm:^7.2.3, undici@npm:^7.21.0": - version: 7.28.0 - resolution: "undici@npm:7.28.0" - checksum: 57c77c4ee75e166ef361ad238fcd88816fbc0d058aeadf4c0f689194bd17eb6d63ce25b89bd4f4d65a380ebbde784bf4886ec51acc9f8c826ecab01d8f63aaac +"undici@npm:7.29.1, undici@npm:^7.1.1, undici@npm:^7.13.0, undici@npm:^7.2.3, undici@npm:^7.21.0": + version: 7.29.1 + resolution: "undici@npm:7.29.1" + checksum: 1e78f8920a92e60f1cb1489dac1066424e5afcbd27131638389731c7ad53dbfa6c6f3a77c335f9607cce80a4ca273c38a6d7316f0041ce37a3f51364c6531296 languageName: node linkType: hard From 30dcff7edd1b9fc25af0097031b85e183c13d2b1 Mon Sep 17 00:00:00 2001 From: Jessica He Date: Fri, 4 Sep 2026 17:10:57 -0400 Subject: [PATCH 2/2] partial patch for dompurify to 3.4.14 --- dynamic-plugins/yarn.lock | 6 +++--- yarn.lock | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dynamic-plugins/yarn.lock b/dynamic-plugins/yarn.lock index 4ed64a595d..2c7f1fc6cd 100644 --- a/dynamic-plugins/yarn.lock +++ b/dynamic-plugins/yarn.lock @@ -20616,14 +20616,14 @@ __metadata: linkType: hard "dompurify@npm:^3.2.4": - version: 3.4.12 - resolution: "dompurify@npm:3.4.12" + version: 3.4.14 + resolution: "dompurify@npm:3.4.14" dependencies: "@types/trusted-types": ^2.0.7 dependenciesMeta: "@types/trusted-types": optional: true - checksum: 477e944e669bac9247c9ebfa55c7ea5c73f3cc6cd6b21ee72e306000e3e53d308e7bdaac89e655a0e2661de2ffbdd877e6a92537d07ba1d70c6c441fcef8c65c + checksum: b33560cfe33df810449ab31d216d37d5d33aaa21843650bc9fc8e0a52b2f9c3e92d3574b3272b6ed701ac7f74e19ee0983689469a36fab68472528f568decb1d languageName: node linkType: hard diff --git a/yarn.lock b/yarn.lock index fb28d266e1..6d3478501b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -21850,14 +21850,14 @@ __metadata: linkType: hard "dompurify@npm:^3.3.1, dompurify@npm:^3.4.12": - version: 3.4.12 - resolution: "dompurify@npm:3.4.12" + version: 3.4.14 + resolution: "dompurify@npm:3.4.14" dependencies: "@types/trusted-types": ^2.0.7 dependenciesMeta: "@types/trusted-types": optional: true - checksum: 477e944e669bac9247c9ebfa55c7ea5c73f3cc6cd6b21ee72e306000e3e53d308e7bdaac89e655a0e2661de2ffbdd877e6a92537d07ba1d70c6c441fcef8c65c + checksum: b33560cfe33df810449ab31d216d37d5d33aaa21843650bc9fc8e0a52b2f9c3e92d3574b3272b6ed701ac7f74e19ee0983689469a36fab68472528f568decb1d languageName: node linkType: hard