From f82e9f55c6041fc6bb3f43f871671f3b28b7e767 Mon Sep 17 00:00:00 2001 From: Michael Tsolakis Date: Tue, 11 Aug 2026 14:42:20 +1000 Subject: [PATCH] fix(deps): resolve Dependabot HIGH/MODERATE vulnerability alerts Bumps adm-zip to 0.5.18 (CVE-2026-39244, zcli-apps/zcli-connectors) and removes the uuid dependency in zcli-apps in favor of Node's built-in crypto.randomUUID(), which sidesteps CVE-2026-41907 entirely (the CVE affects v3/v5/v6, not v4, but the fixed release is ESM-only and would break this project's CommonJS build). Co-Authored-By: Claude Sonnet 5 --- packages/zcli-apps/package.json | 6 ++---- packages/zcli-apps/src/utils/uuid.ts | 4 ++-- packages/zcli-connectors/package.json | 2 +- yarn.lock | 13 ++++--------- 4 files changed, 9 insertions(+), 16 deletions(-) diff --git a/packages/zcli-apps/package.json b/packages/zcli-apps/package.json index 9d66f854..4ff0e15c 100644 --- a/packages/zcli-apps/package.json +++ b/packages/zcli-apps/package.json @@ -21,7 +21,7 @@ "type:check": "tsc" }, "dependencies": { - "adm-zip": "0.5.10", + "adm-zip": "0.5.18", "archiver": "^5.3.1", "axios": "^1.12.0", "chalk": "^4.1.2", @@ -32,8 +32,7 @@ "morgan": "^1.10.0", "rimraf": "^3.0.2", "semver": "^7.3.2", - "tslib": "^2.4.0", - "uuid": "^8.3.2" + "tslib": "^2.4.0" }, "devDependencies": { "@oclif/test": "=2.1.0", @@ -44,7 +43,6 @@ "@types/mocha": "^9.1.1", "@types/morgan": "^1.9.0", "@types/rimraf": "^3.0.2", - "@types/uuid": "^8.3.4", "chai": "^4", "eslint": "^8.18.0", "eslint-config-oclif": "^4.0.0", diff --git a/packages/zcli-apps/src/utils/uuid.ts b/packages/zcli-apps/src/utils/uuid.ts index d52df607..4600cec6 100644 --- a/packages/zcli-apps/src/utils/uuid.ts +++ b/packages/zcli-apps/src/utils/uuid.ts @@ -1,3 +1,3 @@ -import * as uuid from 'uuid' +import { randomUUID } from 'crypto' -export const uuidV4 = () => uuid.v4() +export const uuidV4 = () => randomUUID() diff --git a/packages/zcli-connectors/package.json b/packages/zcli-connectors/package.json index 38aaca1d..0a6dfd3e 100644 --- a/packages/zcli-connectors/package.json +++ b/packages/zcli-connectors/package.json @@ -25,7 +25,7 @@ "@rollup/plugin-babel": "^6.0.0", "@rollup/plugin-commonjs": "^25.0.0", "@rollup/plugin-node-resolve": "^15.0.0", - "adm-zip": "0.5.10", + "adm-zip": "0.5.18", "archiver": "^5.3.1", "axios": "^1.12.0", "chalk": "^4.1.2", diff --git a/yarn.lock b/yarn.lock index 492537eb..405d6845 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2563,11 +2563,6 @@ dependencies: "@types/node" "*" -"@types/uuid@^8.3.4": - version "8.3.4" - resolved "https://registry.yarnpkg.com/@types/uuid/-/uuid-8.3.4.tgz#bd86a43617df0594787d38b735f55c805becf1bc" - integrity sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw== - "@types/ws@^8.5.4": version "8.5.4" resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.5.4.tgz#bb10e36116d6e570dd943735f86c933c1587b8a5" @@ -2788,10 +2783,10 @@ add-stream@^1.0.0: resolved "https://registry.yarnpkg.com/add-stream/-/add-stream-1.0.0.tgz#6a7990437ca736d5e1288db92bd3266d5f5cb2aa" integrity sha512-qQLMr+8o0WC4FZGQTcJiKBVC59JylcPSrTtk6usvmIDFUOCKegapy1VHQwRbFMOFyb/inzUVqHs+eMYKDM1YeQ== -adm-zip@0.5.10: - version "0.5.10" - resolved "https://registry.yarnpkg.com/adm-zip/-/adm-zip-0.5.10.tgz#4a51d5ab544b1f5ce51e1b9043139b639afff45b" - integrity sha512-x0HvcHqVJNTPk/Bw8JbLWlWoo6Wwnsug0fnYYro1HBrjxZ3G7/AZk7Ahv8JwDe1uIcz8eBqvu86FuF1POiG7vQ== +adm-zip@0.5.18: + version "0.5.18" + resolved "https://registry.yarnpkg.com/adm-zip/-/adm-zip-0.5.18.tgz#283a05f2bf1e3fd315f0f31cde29b7a6e3c1619d" + integrity sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng== agent-base@^7.1.0, agent-base@^7.1.2: version "7.1.4"