diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2cb309bd6..ef90fa333 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,7 +8,9 @@ overrides: brace-expansion: '>=5.0.9' minimatch: '>=9.0.0' uuid: '>=14.0.0' - fast-uri: '>=3.1.5 <4' + fast-uri: '>=3.1.6 <4' + qs: '>=6.16.0 <7' + '@xmldom/xmldom': '>=0.9.12 <0.10' '@babel/core': '>=7.29.1 <8' '@hono/node-server': '>=2.0.5' hono: '>=4.12.34 <5' @@ -2238,8 +2240,8 @@ packages: peerDependencies: storybook: ^8.2.0 - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} abbrev@2.0.0: @@ -3343,6 +3345,7 @@ packages: eslint@9.39.5: resolution: {integrity: sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} + deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options. hasBin: true peerDependencies: jiti: '*' @@ -3481,8 +3484,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} fastest-levenshtein@1.0.16: resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==} @@ -5417,8 +5420,8 @@ packages: resolution: {integrity: sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==} engines: {node: '>=20'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} querystringify@2.2.0: @@ -6408,12 +6411,12 @@ packages: vue-component-type-helpers@2.2.12: resolution: {integrity: sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==} + vue-component-type-helpers@3.3.11: + resolution: {integrity: sha512-LwcxzeliO9fkQcpJG0PoX8X5kmAhKmH9wkpDLxNabwzkQ9Zeib2YVHwFV4pcWmMLfXVfjr/dSV+DaJ3cIPgSNA==} + vue-component-type-helpers@3.3.8: resolution: {integrity: sha512-troqCMmQodQDqUqn63NQaFi+CDSclSe7sc8VEBFqf5GFLqmGR2Ph3P2WEC7qwpRVyEWsTi/aAr4vyOe/B1hU3g==} - vue-component-type-helpers@3.3.9: - resolution: {integrity: sha512-3c/UfMe0SqyEfcGTyH7mfshHagJ9QTCbppCb0/uGpHZpFug7+If3GeGZN7I0YheKEExemx3xldQPoO7PQSOLQg==} - vue-demi@0.14.10: resolution: {integrity: sha512-nMZBOwuzabUO0nLgIcc6rycZEebF6eeUfaiQx9+WSk8e29IbLvPU9feI6tqW4kTo3hvoYAJkMh8n8D0fuISphg==} engines: {node: '>=12'} @@ -8054,7 +8057,7 @@ snapshots: ts-dedent: 2.3.0 type-fest: 2.19.0 vue: 3.5.40(typescript@5.9.3) - vue-component-type-helpers: 3.3.9 + vue-component-type-helpers: 3.3.11 '@storybook/vue3@8.6.18(storybook@8.6.18(prettier@3.9.6))(vue@3.5.40(typescript@6.0.3))': dependencies: @@ -8068,7 +8071,7 @@ snapshots: ts-dedent: 2.3.0 type-fest: 2.19.0 vue: 3.5.40(typescript@6.0.3) - vue-component-type-helpers: 3.3.9 + vue-component-type-helpers: 3.3.11 '@swc/core-darwin-arm64@1.15.46': optional: true @@ -8841,7 +8844,7 @@ snapshots: dependencies: storybook: 8.6.18(prettier@3.9.6) - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} abbrev@2.0.0: {} @@ -8887,7 +8890,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -9152,7 +9155,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -10299,7 +10302,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.7 - qs: 6.15.3 + qs: 6.16.0 range-parser: 1.3.0 router: 2.2.0 send: 1.2.1 @@ -10350,7 +10353,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.5: {} + fast-uri@3.1.7: {} fastest-levenshtein@1.0.16: {} @@ -12494,7 +12497,7 @@ snapshots: dependencies: hookified: 2.2.0 - qs@6.15.3: + qs@6.16.0: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -13154,7 +13157,7 @@ snapshots: svg2ttf@6.1.0: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 argparse: 2.0.1 cubic2quad: 1.2.1 lodash: 4.18.1 @@ -13464,7 +13467,7 @@ snapshots: union@0.5.0: dependencies: - qs: 6.15.3 + qs: 6.16.0 unique-filename@4.0.0: dependencies: @@ -13649,9 +13652,9 @@ snapshots: vue-component-type-helpers@2.2.12: {} - vue-component-type-helpers@3.3.8: {} + vue-component-type-helpers@3.3.11: {} - vue-component-type-helpers@3.3.9: {} + vue-component-type-helpers@3.3.8: {} vue-demi@0.14.10(vue@3.5.40(typescript@6.0.3)): dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 9a2c3c384..baa044489 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -22,7 +22,9 @@ overrides: brace-expansion: ">=5.0.9" # GHSA-rgw5-rvv9-x895 (DoS, CVE-2026-14257 mitigation bypass), patched 5.0.9 — supersedes GHSA-mh99-v99m-4gvg minimatch: ">=9.0.0" # keeps minimatch@3 chains out so the brace-expansion force stays within one API major uuid: ">=14.0.0" # GHSA-w5hq-g745-h8pq, patched 11.1.1; jest/storybook chains pin 8.x/9.x - fast-uri: ">=3.1.5 <4" # GHSA-7p8r-x3mc-p8w7 (host confusion via backslash), patched 3.1.5; bounded to 3.x — ajv pins ^3 + fast-uri: ">=3.1.6 <4" # GHSA-jqff-g426-hqxp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf (host confusion/SSRF), patched 3.1.6; bounded to 3.x — ajv pins ^3 + qs: ">=6.16.0 <7" # GHSA-4mjr-xmp4-gh2g (DoS via isBuffer) and GHSA-x5fp-wj9c-mxmx (array-limit bypass), patched 6.16.0; bounded to 6.x — express/union pin ^6 + "@xmldom/xmldom": ">=0.9.12 <0.10" # GHSA-6gmq-8vp8-gcm6 (XML fragment injection), patched 0.9.12; bounded — 0.x minors break API "@babel/core": ">=7.29.1 <8" # bounded: peer ranges (^7 || ^8.0.0-0) would jump to Babel 8 "@hono/node-server": ">=2.0.5" # GHSA-frvp-7c67-39w9; MCP SDK still pins ^1.19.x — drop when the SDK moves to ^2 hono: ">=4.12.34 <5" # GHSA-8j4g-w8fx-2239 (ReDoS in CORS middleware), patched 4.12.34; bounded to 4.x — MCP SDK pins ^4