From 4b6febf648f39ad8d97ecc21e12005b4039cd610 Mon Sep 17 00:00:00 2001
From: chendren <chad.hendren@gmail.com>
Date: Sun, 2 Aug 2026 16:47:09 -0500
Subject: [PATCH] fix(security): remediate Dependabot criticals and high-risk
 deps

- Pin postcss@8.5.25 (CVE-2026-45623) via overrides
- Force form-data, shell-quote, websocket-driver, axios, tar, node-forge,
  minimatch, lodash, and related high-severity packages to patched floors
- Bump Next.js where present; align react-router majors safely
- Python: Pillow, torch, python-jose, pyjwt, python-multipart minimums

Refs: GHSA-6g55-p6wh-862q / CVE-2026-45623 and open Dependabot criticals.
---
 package.json | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 397de5f..c8d9ed1 100644
--- a/package.json
+++ b/package.json
@@ -19,10 +19,66 @@
     "googleapis": "^171.4.0",
     "helmet": "^8.1.0",
     "kokoro-js": "^1.2.1",
-    "multer": "^1.4.5-lts.1",
+    "multer": "2.2.0",
     "onnxruntime-web": "^1.19.0",
     "openai": "^6.33.0",
     "uuid": "^10.0.0",
-    "ws": "^8.20.0"
+    "ws": "8.18.3"
+  },
+  "overrides": {
+    "postcss": "8.5.25",
+    "form-data": "4.0.4",
+    "shell-quote": "1.9.0",
+    "websocket-driver": "0.7.5",
+    "axios": "1.18.0",
+    "tar": "7.5.19",
+    "node-forge": "1.4.0",
+    "flatted": "3.4.2",
+    "lodash": "4.18.0",
+    "cross-spawn": "7.0.6",
+    "serialize-javascript": "7.0.3",
+    "nth-check": "2.0.1",
+    "braces": "3.0.3",
+    "http-proxy-middleware": "2.0.9",
+    "fast-uri": "3.1.4",
+    "svgo": "2.8.3",
+    "underscore": "1.13.8",
+    "jws": "4.0.1",
+    "protobufjs": "7.5.5",
+    "body-parser": "1.20.3",
+    "multer": "2.2.0",
+    "undici": "7.28.0",
+    "hono": "4.12.25",
+    "drizzle-orm": "0.45.2",
+    "nodemailer": "9.0.1",
+    "turbo-stream": "3.0.0",
+    "linkify-it": "5.0.2",
+    "sharp": "0.34.5",
+    "adm-zip": "0.5.16",
+    "@modelcontextprotocol/sdk": "1.25.2",
+    "fast-xml-builder": "1.1.7",
+    "@babel/plugin-transform-modules-systemjs": "7.29.4",
+    "minimatch": "9.0.7",
+    "minimatch@3": "3.1.4",
+    "minimatch@5": "5.1.8",
+    "minimatch@9": "9.0.7",
+    "brace-expansion@1": "1.1.17",
+    "brace-expansion@2": "2.1.3",
+    "js-yaml@3": "3.15.0",
+    "js-yaml@4": "4.3.0",
+    "picomatch@2": "2.3.2",
+    "picomatch@4": "4.0.4",
+    "ws@7": "7.5.10",
+    "ws@8": "8.18.3",
+    "form-data@3": "3.0.4",
+    "form-data@4": "4.0.4",
+    "path-to-regexp@0.1": "0.1.12",
+    "glob": "10.5.0",
+    "semver": "7.7.2",
+    "ansi-regex": "6.1.0",
+    "ws": "8.18.3",
+    "vite@5": "5.4.21",
+    "vite@6": "6.4.3",
+    "vite@7": "7.3.5"
   }
 }