From 2e94504bab3b0c8aea72aa36c5e182592b3584e4 Mon Sep 17 00:00:00 2001 From: Gaya KACI <163902005+kacigaya@users.noreply.github.com> Date: Sun, 25 Oct 2026 15:58:01 +0000 Subject: [PATCH] fix(deps): patch known dependency advisories Replace affected DOMPurify, fast-uri, KaTeX, seroval, shell-quote, and undici resolutions. Cover transitive and mobile Markdown copies, while keeping undici on its existing major lines. --- apps/web/package.json | 4 +- pnpm-lock.yaml | 106 ++++++++++++++++++++++-------------------- pnpm-workspace.yaml | 9 +++- 3 files changed, 66 insertions(+), 53 deletions(-) diff --git a/apps/web/package.json b/apps/web/package.json index 2ad03efe77e15..6f959987a7bb0 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -54,7 +54,7 @@ "@tiptap/starter-kit": "^3.31.3", "class-variance-authority": "^0.7.1", "culori": "^4.0.2", - "dompurify": "^3.4.16", + "dompurify": "^3.4.17", "effect": "catalog:", "hast-util-to-html": "^9.0.5", "hast-util-to-jsx-runtime": "^2.3.6", @@ -62,7 +62,7 @@ "jose": "catalog:", "jsonc-parser": "3.3.1", "jszip": "3.10.1", - "katex": "^0.16.47", + "katex": "^0.18.2", "lucide": "^0.564.0", "lucide-react": "^0.564.0", "morphicons": "^1.7.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5a0ef250c5280..13b4aabf28f1d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -246,13 +246,19 @@ catalogs: specifier: npm:@tsc-rs/typescript@0.8.0 version: 0.8.0 undici: - specifier: 8.11.2 - version: 8.11.2 + specifier: 8.12.2 + version: 8.12.2 unified: specifier: 11.0.5 version: 11.0.5 overrides: + fast-uri@^3: 3.1.9 + katex: 0.18.2 + seroval@^1: 1.6.3 + shell-quote@^1: 1.11.0 + undici@^6: 6.29.1 + undici@^7: 7.30.1 react-native-image-viewing: 0.2.2 mdast-util-math: 3.0.0 micromark-extension-llm-math: 3.1.0 @@ -335,7 +341,7 @@ overrides: lightningcss: 1.33.0 tailwindcss: 4.3.3 '@types/ws@^8': 8.18.2 - undici@^8: 8.11.2 + undici@^8: 8.12.2 ws@^8: 8.22.0 vite: npm:@voidzero-dev/vite-plus-core@1.4.0 vite-plus: 1.4.0 @@ -739,7 +745,7 @@ importers: version: 0.25.1(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0) react-native-enriched-markdown: specifier: file:deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz - version: file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz(katex@0.16.47)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0) + version: file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz(katex@0.18.2)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0) react-native-gesture-handler: specifier: 3.3.0 version: 3.3.0(patch_hash=abe20e1d1c23549297cbbc818e14fe479b41455930d9663135d6b40fe359b626)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0) @@ -920,7 +926,7 @@ importers: version: 3.6.0 undici: specifier: 'catalog:' - version: 8.11.2 + version: 8.12.2 yaml: specifier: ^2.9.0 version: 2.9.0 @@ -1109,8 +1115,8 @@ importers: specifier: ^4.0.2 version: 4.0.2 dompurify: - specifier: ^3.4.16 - version: 3.4.16 + specifier: ^3.4.17 + version: 3.4.17 effect: specifier: 4.0.5 version: 4.0.5 @@ -1133,8 +1139,8 @@ importers: specifier: 3.10.1 version: 3.10.1 katex: - specifier: ^0.16.47 - version: 0.16.47 + specifier: 0.18.2 + version: 0.18.2 lucide: specifier: ^0.564.0 version: 0.564.0 @@ -8010,8 +8016,8 @@ packages: resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==} engines: {node: '>= 4'} - dompurify@3.4.16: - resolution: {integrity: sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==} + dompurify@3.4.17: + resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==} domutils@3.2.2: resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==} @@ -8743,8 +8749,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.8: - resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -9361,8 +9367,8 @@ packages: jszip@3.10.1: resolution: {integrity: sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==} - katex@0.16.47: - resolution: {integrity: sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==} + katex@0.18.2: + resolution: {integrity: sha512-3snve4y0SXTMequLim1FMiPvLGElySam0blN5xQZBqEY3lOJz1TnuaaiugnBZBqHzlSAGmFTYL7MCQkORuLKCA==} hasBin: true keyv@4.5.4: @@ -10659,7 +10665,7 @@ packages: resolution: {integrity: sha512-3eYvMd4EGUboGP4GoPLf5TF/hWqhPpbCB3AX/z1eQrEdiceizGNKszqGwoLV4M1KyGyWOf2UPNbviZoT21S+8g==, tarball: file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz} version: 1.2.0-t3.16 peerDependencies: - katex: '>=0.16.0' + katex: 0.18.2 react: '*' react-native: '*' peerDependenciesMeta: @@ -11013,10 +11019,10 @@ packages: resolution: {integrity: sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw==} engines: {node: '>=10'} peerDependencies: - seroval: ^1.0 + seroval: 1.6.3 - seroval@1.5.4: - resolution: {integrity: sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw==} + seroval@1.6.3: + resolution: {integrity: sha512-5PwLbVPpT4DEki1hYVSSsoxWY6xCNMVucAVLK/CH0mXSDfp/I4KaAex72q80GNt5hpn7CCMGdSpIg4YGqH/wXQ==} engines: {node: '>=10'} serve-static@1.16.3: @@ -11054,8 +11060,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.10.0: - resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==} + shell-quote@1.11.0: + resolution: {integrity: sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g==} engines: {node: '>= 0.4'} shiki@4.2.0: @@ -11506,16 +11512,16 @@ packages: undici-types@7.16.0: resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==} - undici@6.29.0: - resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} + undici@6.29.1: + resolution: {integrity: sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==} engines: {node: '>=18.17'} - undici@7.29.1: - resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} + undici@7.30.1: + resolution: {integrity: sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==} engines: {node: '>=20.18.1'} - undici@8.11.2: - resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} + undici@8.12.2: + resolution: {integrity: sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg==} engines: {node: '>=22.19.0'} unenv@2.0.0-rc.24: @@ -12172,7 +12178,7 @@ snapshots: '@ai-sdk/provider': 3.0.18 '@standard-schema/spec': 1.1.0 eventsource-parser: 3.1.0 - undici: 6.29.0 + undici: 6.29.1 zod: 4.4.3 '@ai-sdk/provider@3.0.15': @@ -13556,7 +13562,7 @@ snapshots: '@effect/platform-node-shared': 4.0.5(bufferutil@4.1.0)(effect@4.0.5)(utf-8-validate@6.0.6) effect: 4.0.5 redis: 6.2.1 - undici: 8.11.2 + undici: 8.12.2 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -13676,7 +13682,7 @@ snapshots: semver: 7.8.5 sumchecker: 3.0.1(supports-color@8.1.1) optionalDependencies: - undici: 7.29.1 + undici: 7.30.1 transitivePeerDependencies: - supports-color @@ -16064,8 +16070,8 @@ snapshots: dependencies: '@tanstack/history': 1.162.0 cookie-es: 3.1.1 - seroval: 1.5.4 - seroval-plugins: 1.5.4(seroval@1.5.4) + seroval: 1.6.3 + seroval-plugins: 1.5.4(seroval@1.6.3) '@tanstack/router-generator@1.167.12(supports-color@8.1.1)': dependencies: @@ -17016,7 +17022,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.8 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -18059,7 +18065,7 @@ snapshots: dependencies: domelementtype: 2.3.0 - dompurify@3.4.16: + dompurify@3.4.17: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -18848,7 +18854,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.8: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.2: dependencies: @@ -19497,7 +19503,7 @@ snapshots: parse5: 8.0.1 saxes: 6.0.0 tough-cookie: 6.0.2 - undici: 8.11.2 + undici: 8.12.2 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -19554,7 +19560,7 @@ snapshots: readable-stream: 2.3.8 setimmediate: 1.0.5 - katex@0.16.47: + katex@0.18.2: dependencies: commander: 8.3.0 @@ -20215,7 +20221,7 @@ snapshots: dependencies: '@types/katex': 0.16.8 devlop: 1.1.0 - katex: 0.16.47 + katex: 0.18.2 micromark-factory-space: 2.0.1 micromark-util-character: 2.1.1 micromark-util-symbol: 2.0.1 @@ -20488,7 +20494,7 @@ snapshots: semver: 7.8.5 tar: 7.5.22 tinyglobby: 0.2.17 - undici: 6.29.0 + undici: 6.29.1 which: 6.0.1 node-int64@0.4.0: {} @@ -21205,7 +21211,7 @@ snapshots: react-devtools-core@6.1.5(bufferutil@4.1.0)(utf-8-validate@6.0.6): dependencies: - shell-quote: 1.10.0 + shell-quote: 1.11.0 ws: 7.5.11(bufferutil@4.1.0)(utf-8-validate@6.0.6) transitivePeerDependencies: - bufferutil @@ -21259,12 +21265,12 @@ snapshots: react: 19.3.0 react-native: 0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6) - react-native-enriched-markdown@file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz(katex@0.16.47)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0): + react-native-enriched-markdown@file:apps/mobile/deps/react-native-enriched-markdown-1.2.0-t3.16-8d2f84a8.tgz(katex@0.18.2)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0): dependencies: react: 19.3.0 react-native: 0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6) optionalDependencies: - katex: 0.16.47 + katex: 0.18.2 react-native-gesture-handler@3.3.0(patch_hash=abe20e1d1c23549297cbbc818e14fe479b41455930d9663135d6b40fe359b626)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0): dependencies: @@ -21764,11 +21770,11 @@ snapshots: type-fest: 0.13.1 optional: true - seroval-plugins@1.5.4(seroval@1.5.4): + seroval-plugins@1.5.4(seroval@1.6.3): dependencies: - seroval: 1.5.4 + seroval: 1.6.3 - seroval@1.5.4: {} + seroval@1.6.3: {} serve-static@1.16.3(supports-color@8.1.1): dependencies: @@ -21833,7 +21839,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.10.0: {} + shell-quote@1.11.0: {} shiki@4.2.0: dependencies: @@ -22278,12 +22284,12 @@ snapshots: undici-types@7.16.0: {} - undici@6.29.0: {} + undici@6.29.1: {} - undici@7.29.1: + undici@7.30.1: optional: true - undici@8.11.2: {} + undici@8.12.2: {} unenv@2.0.0-rc.24: dependencies: @@ -22314,7 +22320,7 @@ snapshots: dependencies: css-tree: 3.2.1 ohash: 2.0.12 - undici: 8.11.2 + undici: 8.12.2 unist-util-is@6.0.1: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 39b020f198872..821022b754a6f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -72,7 +72,7 @@ catalog: tailwindcss: 4.3.3 tldts: 7.4.2 typescript: npm:@tsc-rs/typescript@0.8.0 - undici: 8.11.2 + undici: 8.12.2 vite: npm:@voidzero-dev/vite-plus-core@1.4.0 vite-plus: 1.4.0 ws: 8.22.0 @@ -225,6 +225,13 @@ minimumReleaseAgeExclude: - "@pierre/theming@1.0.2" overrides: + # Security fixes for transitive dependencies, including the mobile Markdown peer. + "fast-uri@^3": 3.1.9 + katex: 0.18.2 + "seroval@^1": 1.6.3 + "shell-quote@^1": 1.11.0 + "undici@^6": 6.29.1 + "undici@^7": 7.30.1 # Pin every patched package, including transitive dependencies, so lockfile-free # release installs cannot drift past the patch. Update these with patchedDependencies. react-native-image-viewing: 0.2.2