diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f0b2d977..efe5d3f3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -314,9 +314,10 @@ catalogs: overrides: body-parser: 1.20.6 body-parser>qs: 6.16.0 - brace-expansion@1: 1.1.18 - brace-expansion@2: 2.1.4 - brace-expansion@5: 5.0.9 + brace-expansion@1: 1.1.21 + brace-expansion@2: 2.1.7 + brace-expansion@5: 5.0.12 + devalue: 5.9.4 js-yaml: 4.3.2 nanoid@3: 3.3.18 nanoid@5: 5.1.16 @@ -1117,8 +1118,8 @@ importers: specifier: 'catalog:' version: 5.9.3 undici: - specifier: ^7.0.0 - version: 7.29.0 + specifier: ^7.30.0 + version: 7.30.0 packages: @@ -4433,14 +4434,14 @@ packages: resolution: {integrity: sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw==} engines: {node: '>=18'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -4889,8 +4890,8 @@ packages: resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==} engines: {node: '>=8'} - devalue@5.9.0: - resolution: {integrity: sha512-RWrqdArjvPbsATEhOPUo6Wndc/iWnkWKlhIrdlF3zMMYo/c3CVtoaVAyLtWxz5h8nSlkHzxnzV2uLydPXmtF+A==} + devalue@5.9.4: + resolution: {integrity: sha512-sPAT4pztbu6586/hrhOnMKS17IJrvg12mXiSPSS3W5qDeN2RGgvZ0diZCm31dBbnevfVmujNO3IM2wrS4Y2Rhg==} diff@8.0.4: resolution: {integrity: sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==} @@ -7686,12 +7687,12 @@ packages: undici-types@7.14.0: resolution: {integrity: sha512-QQiYxHuyZ9gQUIrmPo3IA+hUl4KYk8uSA7cHrcKd/l3p1OTpZcM0Tbp9x7FAtXdAYhlasd60ncPpgu6ihG6TOA==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} - undici@8.10.0: - resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} + undici@8.11.2: + resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} engines: {node: '>=22.19.0'} unenv@2.0.0-rc.24: @@ -9783,7 +9784,7 @@ snapshots: consola: 3.4.2 defu: 6.1.7 destr: 2.0.5 - devalue: 5.9.0 + devalue: 5.9.4 errx: 0.1.2 escape-string-regexp: 5.0.0 exsolve: 1.1.1 @@ -9857,7 +9858,7 @@ snapshots: consola: 3.4.2 defu: 6.1.7 destr: 2.0.5 - devalue: 5.9.0 + devalue: 5.9.4 errx: 0.1.2 escape-string-regexp: 5.0.0 exsolve: 1.1.1 @@ -11946,16 +11947,16 @@ snapshots: widest-line: 5.0.0 wrap-ansi: 9.0.2 - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.3 @@ -12415,7 +12416,7 @@ snapshots: detect-libc@2.1.2: {} - devalue@5.9.0: {} + devalue@5.9.4: {} diff@8.0.4: {} @@ -13893,19 +13894,19 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minipass@7.1.3: {} @@ -14167,7 +14168,7 @@ snapshots: cookie-es: 2.0.1 defu: 6.1.7 destr: 2.0.5 - devalue: 5.9.0 + devalue: 5.9.4 errx: 0.1.2 escape-string-regexp: 5.0.0 exsolve: 1.1.1 @@ -14296,7 +14297,7 @@ snapshots: consola: 3.4.2 cookie-es: 3.1.1 defu: 6.1.7 - devalue: 5.9.0 + devalue: 5.9.4 errx: 0.1.2 escape-string-regexp: 5.0.0 exsolve: 1.1.1 @@ -14331,7 +14332,7 @@ snapshots: ultrahtml: 1.7.0 uncrypto: 0.1.3 unctx: 3.0.0(magic-string@1.1.0)(oxc-parser@0.143.0)(rolldown@1.2.3)(unplugin@3.3.0(esbuild@0.28.1)(rolldown@1.2.3)(rollup@4.62.2)(vite@8.2.1(@types/node@24.7.2)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0))) - undici: 8.10.0 + undici: 8.11.2 unhead: 3.3.1(esbuild@0.28.1)(rolldown@1.2.3)(rollup@4.62.2)(vite@8.2.1(@types/node@24.7.2)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0)) unimport: 6.4.0(esbuild@0.28.1)(oxc-parser@0.143.0)(rolldown@1.2.3)(rollup@4.62.2)(vite@8.2.1(@types/node@24.7.2)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0)) unplugin: 3.3.0(esbuild@0.28.1)(rolldown@1.2.3)(rollup@4.62.2)(vite@8.2.1(@types/node@24.7.2)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0)) @@ -15978,9 +15979,9 @@ snapshots: undici-types@7.14.0: {} - undici@7.29.0: {} + undici@7.30.0: {} - undici@8.10.0: {} + undici@8.11.2: {} unenv@2.0.0-rc.24: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 420ca8e7..d2b27b4a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -25,16 +25,25 @@ overrides: # 6.16.0. body-parser>qs: 6.16.0 # JUSTIFICATION: Fixes GHSA-3jxr-9vmj-r5cp / GHSA-mh99-v99m-4gvg / GHSA-rgw5-rvv9-x895 — - # brace-expansion DoS via exponential/unbounded expansion of `{}` groups. Three major lines are + # brace-expansion DoS via exponential/unbounded expansion of `{}` groups — plus GHSA-qhr7-859c-m2p7 + # / GHSA-6j4f-fj2g-mc7p (2026-10-02), stack exhaustion via uncontrolled recursion on nested brace + # groups and in `parseCommaParts`, which need >=1.1.20 / >=2.1.6 / >=5.0.11, above the previous + # 1.1.18 / 2.1.4 / 5.0.9 pins. Three major lines are # pulled in transitively, each needing its own pin: v1 via the root `@thunderid/eslint-plugin` # toolchain (eslint > minimatch > brace-expansion), v2 via packages/nuxt and packages/vue's # `@vue/test-utils` (js-beautify > glob > minimatch > brace-expansion), and v5 via the root # `rimraf` clean scripts (rimraf > glob > minimatch > brace-expansion). Upstream minimatch@latest # already depends on brace-expansion ^5.0.8, so the v5 pin can likely be dropped on the next # `pnpm update` once eslint/js-beautify's own lockfile entries catch up too. - brace-expansion@1: 1.1.18 - brace-expansion@2: 2.1.4 - brace-expansion@5: 5.0.9 + brace-expansion@1: 1.1.21 + brace-expansion@2: 2.1.7 + brace-expansion@5: 5.0.12 + # JUSTIFICATION: Fixes GHSA-j22f-vq7h-c4qm / GHSA-mcm9-63f2-9j32 / GHSA-x5rw-q4pp-hg5g — devalue + # `stringify`/`uneval` serializing shared memory, quadratic expansion of repeated primitive + # strings in `uneval`, and an unhandled rejection from `stringifyAsync`. Transitive via + # packages/nuxt and samples/nuxt/quickstart's `nuxt` and `@nuxt/nitro-server`. Added 2026-10-02; + # remove once nuxt's own lockfile entry resolves devalue >=5.9.3 without the override. + devalue: 5.9.4 # JUSTIFICATION: Fixes GHSA-52cp-r559-cp3m / GHSA-5p4m-2wfm-xmqj — js-yaml quadratic CPU # consumption via YAML merge-key chains and `!!omap` resolution — plus GHSA-2883-xcg3-v3hh # (2026-09-11), where `maxTotalMergeKeys` fails to bound CPU use for empty merge sources, which @@ -95,6 +104,13 @@ auditConfig: # (chrome87/edge88/firefox78/safari14). Revisit once esbuild backports the fix to 0.27.x or # the sample's target list is modernized. - GHSA-g7r4-m6w7-qqqr + # JUSTIFICATION: GHSA-86w9-cpqp-85rv — node-forge accepts extra nested DigestAlgorithm elements + # during RSA PKCS#1 v1.5 signature verification. No patched release exists (1.4.0 is the + # latest and is affected). Transitive via nuxt's dev tooling (`@nuxt/cli` / `nitropack` > + # `listhen` > `node-forge`), which only uses it to generate RSA keys and self-signed + # certificates for the local HTTPS dev server — it never verifies signatures. Added + # 2026-10-02; revisit once node-forge publishes a fixed release. + - GHSA-86w9-cpqp-85rv catalog: '@emotion/css': 11.13.5 diff --git a/tests/e2e/package.json b/tests/e2e/package.json index 8a25fbe4..1c776f12 100644 --- a/tests/e2e/package.json +++ b/tests/e2e/package.json @@ -28,6 +28,6 @@ "prettier": "catalog:", "rimraf": "catalog:", "typescript": "catalog:", - "undici": "^7.0.0" + "undici": "^7.30.0" } }