From 07caa05b079fb4a322e23460c5ab07ecb02d97dc Mon Sep 17 00:00:00 2001 From: Bas950 Date: Mon, 26 Oct 2026 11:29:10 +0100 Subject: [PATCH 1/3] fix(security): patch CVE-2026-111497 runtime and vulnerable dependencies Bump pinned Node/CI runtimes and override vulnerable npm dependencies to patched versions. --- .github/workflows/publish.yaml | 6 +- .github/workflows/test.yaml | 6 +- package.json | 8 +- pnpm-lock.yaml | 135 +++++++++++++++++++-------------- 4 files changed, 90 insertions(+), 65 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index ff2aaf4..8d48675 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -12,10 +12,10 @@ jobs: - name: Checkout repository uses: actions/checkout@v3 - - name: Install Node v16 + - name: Install Node v24 uses: actions/setup-node@v3.4.1 with: - node-version: 16 + node-version: 24.22.1 registry-url: "https://registry.npmjs.org" - name: Cache pnpm modules @@ -29,7 +29,7 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@v2.2.2 with: - version: 6.0.2 + version: 8.15.9 - name: Install dependencies run: pnpm i diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 031b3d5..060890f 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -10,10 +10,10 @@ jobs: - name: Checkout repository uses: actions/checkout@v3 - - name: Install Node v16 + - name: Install Node v24 uses: actions/setup-node@v3.4.1 with: - node-version: 16 + node-version: 24.22.1 - name: Cache pnpm modules uses: actions/cache@v3 @@ -26,7 +26,7 @@ jobs: - name: Install pnpm uses: pnpm/action-setup@v2.2.2 with: - version: 6.0.2 + version: 8.15.9 - name: Install dependencies run: pnpm i diff --git a/package.json b/package.json index 405a806..765c21d 100644 --- a/package.json +++ b/package.json @@ -28,5 +28,11 @@ "commands", "slash", "slashcommands" - ] + ], + "pnpm": { + "overrides": { + "ws@>=8.0.0 <8.21.0": "^8.21.0", + "undici@>=5.0.0 <5.19.1": "^5.19.1" + } + } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bdd41fd..652a770 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1,26 +1,38 @@ -lockfileVersion: 5.4 +lockfileVersion: '6.0' -specifiers: - '@types/debug': ^4.1.7 - '@types/node': ^18.7.2 - debug: ^4.3.4 - discord.js: ^14.2.0 - source-map-support: ^0.5.21 - typescript: ^4.7.4 +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +overrides: + ws@>=8.0.0 <8.21.0: ^8.21.0 + undici@>=5.0.0 <5.19.1: ^5.19.1 dependencies: - debug: 4.3.4 - discord.js: 14.2.0 - source-map-support: 0.5.21 + debug: + specifier: ^4.3.4 + version: 4.3.4 + discord.js: + specifier: ^14.2.0 + version: 14.2.0 + source-map-support: + specifier: ^0.5.21 + version: 0.5.21 devDependencies: - '@types/debug': 4.1.7 - '@types/node': 18.7.2 - typescript: 4.7.4 + '@types/debug': + specifier: ^4.1.7 + version: 4.1.7 + '@types/node': + specifier: ^18.7.2 + version: 18.7.2 + typescript: + specifier: ^4.7.4 + version: 4.7.4 packages: - /@discordjs/builders/1.1.0: + /@discordjs/builders@1.1.0: resolution: {integrity: sha512-EO8TSltiIc9Z1wE854wAFvv5AccqEtvjFmao9PPoxQhRaJ0hEb7FwWRTCA1jGg4ZWI3hcp4m+RET5ufZQz3rOg==} engines: {node: '>=16.9.0'} dependencies: @@ -31,12 +43,12 @@ packages: tslib: 2.4.0 dev: false - /@discordjs/collection/1.0.1: + /@discordjs/collection@1.0.1: resolution: {integrity: sha512-5V/wswzR3r2RVYXLxxg4TvrAnBhVCNgHTXhC+OUtLoriJ072rPMHo+Iw1SS1vrCckp8Es40XM411+WkNRPaXFw==} engines: {node: '>=16.9.0'} dev: false - /@discordjs/rest/1.0.1: + /@discordjs/rest@1.0.1: resolution: {integrity: sha512-w08CTKVzzYYvKxEjXKOs9AdS7KQ1J502TrPfF8eCZ2lF6AfKuMP/32YgDakiwIyYTDjEQS/v0nKLSFcncHRMtg==} engines: {node: '>=16.9.0'} dependencies: @@ -46,15 +58,20 @@ packages: discord-api-types: 0.36.3 file-type: 17.1.6 tslib: 2.4.0 - undici: 5.8.2 + undici: 5.29.0 + dev: false + + /@fastify/busboy@2.1.1: + resolution: {integrity: sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==} + engines: {node: '>=14'} dev: false - /@sapphire/async-queue/1.4.0: + /@sapphire/async-queue@1.4.0: resolution: {integrity: sha512-1npoLO1YPPXCsWCfuonsSdtHbPUo6dvjWUJtmUHiK8yDTmy00LbkpRkdV/UycA1fh+QsxwOPhgx2zu64Z+19ww==} engines: {node: '>=v14.0.0', npm: '>=7.0.0'} dev: false - /@sapphire/shapeshift/3.5.1: + /@sapphire/shapeshift@3.5.1: resolution: {integrity: sha512-7JFsW5IglyOIUQI1eE0g6h06D/Far6HqpcowRScgCiLSqTf3hhkPWCWotVTtVycnDCMYIwPeaw6IEPBomKC8pA==} engines: {node: '>=v14.0.0', npm: '>=7.0.0'} dependencies: @@ -62,39 +79,39 @@ packages: lodash.uniqwith: 4.5.0 dev: false - /@sapphire/snowflake/3.2.2: + /@sapphire/snowflake@3.2.2: resolution: {integrity: sha512-ula2O0kpSZtX9rKXNeQMrHwNd7E4jPDJYUXmEGTFdMRfyfMw+FPyh04oKMjAiDuOi64bYgVkOV3MjK+loImFhQ==} engines: {node: '>=v14.0.0', npm: '>=7.0.0'} dev: false - /@tokenizer/token/0.3.0: + /@tokenizer/token@0.3.0: resolution: {integrity: sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==} dev: false - /@types/debug/4.1.7: + /@types/debug@4.1.7: resolution: {integrity: sha512-9AonUzyTjXXhEOa0DnqpzZi6VHlqKMswga9EXjpXnnqxwLtdvPPtlO8evrI5D9S6asFRCQ6v+wpiUKbw+vKqyg==} dependencies: '@types/ms': 0.7.31 dev: true - /@types/ms/0.7.31: + /@types/ms@0.7.31: resolution: {integrity: sha512-iiUgKzV9AuaEkZqkOLDIvlQiL6ltuZd9tGcW3gwpnX8JbuiuhFlEGmmFXEXkN50Cvq7Os88IY2v0dkDqXYWVgA==} dev: true - /@types/node/18.7.2: + /@types/node@18.7.2: resolution: {integrity: sha512-ce7MIiaYWCFv6A83oEultwhBXb22fxwNOQf5DIxWA4WXvDQ7K+L0fbWl/YOfCzlR5B/uFkSnVBhPcOfOECcWvA==} - /@types/ws/8.5.3: + /@types/ws@8.5.3: resolution: {integrity: sha512-6YOoWjruKj1uLf3INHH7D3qTXwFfEsg1kf3c0uDdSBJwfa/llkwIjrAGV7j7mVgGNbzTQ3HiHKKDXl6bJPD97w==} dependencies: '@types/node': 18.7.2 dev: false - /buffer-from/1.1.2: + /buffer-from@1.1.2: resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==} dev: false - /debug/4.3.4: + /debug@4.3.4: resolution: {integrity: sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==} engines: {node: '>=6.0'} peerDependencies: @@ -106,11 +123,11 @@ packages: ms: 2.1.2 dev: false - /discord-api-types/0.36.3: + /discord-api-types@0.36.3: resolution: {integrity: sha512-bz/NDyG0KBo/tY14vSkrwQ/n3HKPf87a0WFW/1M9+tXYK+vp5Z5EksawfCWo2zkAc6o7CClc0eff1Pjrqznlwg==} dev: false - /discord.js/14.2.0: + /discord.js@14.2.0: resolution: {integrity: sha512-kIGhEeOB1d9k7whL9HCCuRuzK2GL7i/hTesYINOZ2szWm4TOsBVwRU+i9O/zDb2M+Gvff4SJ4EpAtCVV0okgVw==} engines: {node: '>=16.9.0'} dependencies: @@ -123,18 +140,18 @@ packages: fast-deep-equal: 3.1.3 lodash.snakecase: 4.1.1 tslib: 2.4.0 - undici: 5.8.2 - ws: 8.8.1 + undici: 5.29.0 + ws: 8.22.0 transitivePeerDependencies: - bufferutil - utf-8-validate dev: false - /fast-deep-equal/3.1.3: + /fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} dev: false - /file-type/17.1.6: + /file-type@17.1.6: resolution: {integrity: sha512-hlDw5Ev+9e883s0pwUsuuYNu4tD7GgpUnOvykjv1Gya0ZIjuKumthDRua90VUn6/nlRKAjcxLUnHNTIUWwWIiw==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} dependencies: @@ -143,32 +160,32 @@ packages: token-types: 5.0.1 dev: false - /ieee754/1.2.1: + /ieee754@1.2.1: resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==} dev: false - /inherits/2.0.4: + /inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} dev: false - /lodash.snakecase/4.1.1: + /lodash.snakecase@4.1.1: resolution: {integrity: sha512-QZ1d4xoBHYUeuouhEq3lk3Uq7ldgyFXGBhg04+oRLnIz8o9T65Eh+8YdroUwn846zchkA9yDsDl5CVVaV2nqYw==} dev: false - /lodash.uniqwith/4.5.0: + /lodash.uniqwith@4.5.0: resolution: {integrity: sha512-7lYL8bLopMoy4CTICbxygAUq6CdRJ36vFc80DucPueUee+d5NBRxz3FdT9Pes/HEx5mPoT9jwnsEJWz1N7uq7Q==} dev: false - /ms/2.1.2: + /ms@2.1.2: resolution: {integrity: sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==} dev: false - /peek-readable/5.0.0: + /peek-readable@5.0.0: resolution: {integrity: sha512-YtCKvLUOvwtMGmrniQPdO7MwPjgkFBtFIrmfSbYmYuq3tKDV/mcfAhBth1+C3ru7uXIZasc/pHnb+YDYNkkj4A==} engines: {node: '>=14.16'} dev: false - /readable-stream/3.6.0: + /readable-stream@3.6.0: resolution: {integrity: sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==} engines: {node: '>= 6'} dependencies: @@ -177,36 +194,36 @@ packages: util-deprecate: 1.0.2 dev: false - /readable-web-to-node-stream/3.0.2: + /readable-web-to-node-stream@3.0.2: resolution: {integrity: sha512-ePeK6cc1EcKLEhJFt/AebMCLL+GgSKhuygrZ/GLaKZYEecIgIECf4UaUuaByiGtzckwR4ain9VzUh95T1exYGw==} engines: {node: '>=8'} dependencies: readable-stream: 3.6.0 dev: false - /safe-buffer/5.2.1: + /safe-buffer@5.2.1: resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==} dev: false - /source-map-support/0.5.21: + /source-map-support@0.5.21: resolution: {integrity: sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==} dependencies: buffer-from: 1.1.2 source-map: 0.6.1 dev: false - /source-map/0.6.1: + /source-map@0.6.1: resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==} engines: {node: '>=0.10.0'} dev: false - /string_decoder/1.3.0: + /string_decoder@1.3.0: resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==} dependencies: safe-buffer: 5.2.1 dev: false - /strtok3/7.0.0: + /strtok3@7.0.0: resolution: {integrity: sha512-pQ+V+nYQdC5H3Q7qBZAz/MO6lwGhoC2gOAjuouGf/VO0m7vQRh8QNMl2Uf6SwAtzZ9bOw3UIeBukEGNJl5dtXQ==} engines: {node: '>=14.16'} dependencies: @@ -214,7 +231,7 @@ packages: peek-readable: 5.0.0 dev: false - /token-types/5.0.1: + /token-types@5.0.1: resolution: {integrity: sha512-Y2fmSnZjQdDb9W4w4r1tswlMHylzWIeOKpx0aZH9BgGtACHhrk3OkT52AzwcuqTRBZtvvnTjDBh8eynMulu8Vg==} engines: {node: '>=14.16'} dependencies: @@ -222,35 +239,37 @@ packages: ieee754: 1.2.1 dev: false - /ts-mixer/6.0.1: + /ts-mixer@6.0.1: resolution: {integrity: sha512-hvE+ZYXuINrx6Ei6D6hz+PTim0Uf++dYbK9FFifLNwQj+RwKquhQpn868yZsCtJYiclZF1u8l6WZxxKi+vv7Rg==} dev: false - /tslib/2.4.0: + /tslib@2.4.0: resolution: {integrity: sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==} dev: false - /typescript/4.7.4: + /typescript@4.7.4: resolution: {integrity: sha512-C0WQT0gezHuw6AdY1M2jxUO83Rjf0HP7Sk1DtXj6j1EwkQNZrHAg2XPWlq62oqEhYvONq5pkC2Y9oPljWToLmQ==} engines: {node: '>=4.2.0'} hasBin: true dev: true - /undici/5.8.2: - resolution: {integrity: sha512-3KLq3pXMS0Y4IELV045fTxqz04Nk9Ms7yfBBHum3yxsTR4XNn+ZCaUbf/mWitgYDAhsplQ0B1G4S5D345lMO3A==} - engines: {node: '>=12.18'} + /undici@5.29.0: + resolution: {integrity: sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==} + engines: {node: '>=14.0'} + dependencies: + '@fastify/busboy': 2.1.1 dev: false - /util-deprecate/1.0.2: + /util-deprecate@1.0.2: resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==} dev: false - /ws/8.8.1: - resolution: {integrity: sha512-bGy2JzvzkPowEJV++hF07hAD6niYSr0JzBNo/J29WsB57A2r7Wlc1UFcTR9IzrPvuNVO4B8LGqF8qcpsVOhJCA==} + /ws@8.22.0: + resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 - utf-8-validate: ^5.0.2 + utf-8-validate: '>=5.0.2' peerDependenciesMeta: bufferutil: optional: true From e95415a94f180fad65a5376cc3e6cbbfc3dad561 Mon Sep 17 00:00:00 2001 From: Bas950 Date: Mon, 26 Oct 2026 11:55:03 +0100 Subject: [PATCH 2/3] ci: use pnpm/action-setup v4 (v2 self-installer fails on Node 24) --- .github/workflows/publish.yaml | 2 +- .github/workflows/test.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 8d48675..3b999c9 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -27,7 +27,7 @@ jobs: ${{ runner.os }}- - name: Install pnpm - uses: pnpm/action-setup@v2.2.2 + uses: pnpm/action-setup@v4 with: version: 8.15.9 diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 060890f..a8a948b 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -24,7 +24,7 @@ jobs: ${{ runner.os }}- - name: Install pnpm - uses: pnpm/action-setup@v2.2.2 + uses: pnpm/action-setup@v4 with: version: 8.15.9 From cf48c63f421eb2ffaf24f779061cc15c16308a28 Mon Sep 17 00:00:00 2001 From: Bas950 Date: Mon, 26 Oct 2026 12:00:08 +0100 Subject: [PATCH 3/3] ci: run the project's pinned tsc instead of the runner's global one --- .github/workflows/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index a8a948b..71511c8 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -32,4 +32,4 @@ jobs: run: pnpm i - name: Test package - run: tsc + run: pnpm exec tsc