From fe94a7fa75104ccd68450ae434e1f9a9259a735f Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Mon, 24 Aug 2026 10:43:23 +0530 Subject: [PATCH] fix(deps): resolve 8 npm advisories via npm overrides Pin four transitive devDependency packages to patched versions via package.json "overrides": - serialize-javascript ^7.1.0 (GHSA-5c6j-r48x-rmvq RCE, GHSA-qj8w-gfj5-8c6v DoS) - uuid ^11.1.1 (GHSA-w5hq-g745-h8pq buffer bounds check) - diff ^8.0.3 (GHSA-73rr-hh4g-fpgx DoS in parsePatch/applyPatch) - brace-expansion@1 ^1.1.18 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 DoS) The brace-expansion@1 entry closes two copies (under eslint and @eslint/eslintrc) that the existing minimatch-scoped overrides did not reach. npm audit: 9 advisories -> 1. Build and all 135 tests pass; snyk test --all-projects reports no vulnerable paths across 463 dependencies. Updates the .talismanrc checksum for package-lock.json to match the new lockfile hash, per the existing convention in this repo (Talisman flags npm's sha512 integrity digests as base64 content). adm-zip (<0.6.0, high) is left unfixed: it is a direct runtime dependency and the only remedy is a breaking 0.6.0 major, so it needs a human decision rather than an automated bump. Co-Authored-By: Claude Opus 5 (1M context) --- .talismanrc | 2 +- package-lock.json | 205 +++++++++++----------------------------------- package.json | 6 +- 3 files changed, 56 insertions(+), 157 deletions(-) mode change 100755 => 100644 package.json diff --git a/.talismanrc b/.talismanrc index 2c71df3..d17028c 100644 --- a/.talismanrc +++ b/.talismanrc @@ -9,7 +9,7 @@ fileignoreconfig: - filename: test/unit/commands/rollback.test.ts checksum: d1f931f2d9a397131409399ad6463653e28b5a2224e870b641d9ba57c4418f18 - filename: package-lock.json - checksum: a713321dbdd291f8087846c9c45793588787eb8adc76faf4f74968964e502d3e + checksum: f57d78f85c1dbe6f1cd1cf4d48f9c8c0d327f26022643fa8cf47b8e706dff210 - filename: src/adapters/github.test.ts checksum: b3d3d3a3c14adde103152d2ac4e1c4b7121a5f7533a87c3cc600f6d25fb59d1b - filename: src/adapters/file-upload.test.ts diff --git a/package-lock.json b/package-lock.json index d15dd0a..2e33258 100644 --- a/package-lock.json +++ b/package-lock.json @@ -911,6 +911,19 @@ "xdg-basedir": "^4.0.0" } }, + "node_modules/@contentstack/cli-utilities/node_modules/uuid": { + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], + "license": "MIT", + "bin": { + "uuid": "dist/esm/bin/uuid" + } + }, "node_modules/@contentstack/management": { "version": "1.30.4", "license": "MIT", @@ -1054,20 +1067,6 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, - "node_modules/@eslint/config-array/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/@eslint/config-array/node_modules/minimatch": { "version": "3.1.5", "dev": true, @@ -1197,20 +1196,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/@eslint/eslintrc/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": { "version": "0.4.1", "dev": true, @@ -2546,14 +2531,6 @@ "node": ">=8" } }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": { - "version": "1.0.10", - "dev": true, - "license": "MIT", - "dependencies": { - "sprintf-js": "~1.0.2" - } - }, "node_modules/@istanbuljs/load-nyc-config/node_modules/find-up": { "version": "4.1.0", "dev": true, @@ -2566,18 +2543,6 @@ "node": ">=8" } }, - "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.0", - "dev": true, - "license": "MIT", - "dependencies": { - "argparse": "^1.0.7", - "esprima": "^4.0.0" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": { "version": "5.0.0", "dev": true, @@ -4564,6 +4529,24 @@ "dev": true, "license": "MIT" }, + "node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/brace-expansion/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, "node_modules/braces": { "version": "3.0.3", "dev": true, @@ -5670,7 +5653,9 @@ } }, "node_modules/diff": { - "version": "7.0.0", + "version": "8.0.4", + "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz", + "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==", "dev": true, "license": "BSD-3-Clause", "engines": { @@ -6340,20 +6325,6 @@ "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9" } }, - "node_modules/eslint-plugin-import/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/eslint-plugin-import/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/eslint-plugin-import/node_modules/debug": { "version": "3.2.7", "dev": true, @@ -6606,20 +6577,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/eslint/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/eslint/node_modules/json-schema-traverse": { "version": "0.4.1", "dev": true, @@ -6652,18 +6609,6 @@ "url": "https://opencollective.com/eslint" } }, - "node_modules/esprima": { - "version": "4.0.1", - "dev": true, - "license": "BSD-2-Clause", - "bin": { - "esparse": "bin/esparse.js", - "esvalidate": "bin/esvalidate.js" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/esquery": { "version": "1.7.0", "dev": true, @@ -7425,20 +7370,6 @@ "node": ">=10.13.0" } }, - "node_modules/glob/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/glob/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/glob/node_modules/minimatch": { "version": "3.1.5", "dev": true, @@ -8915,11 +8846,17 @@ } }, "node_modules/istanbul-lib-processinfo/node_modules/uuid": { - "version": "8.3.2", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", "dev": true, + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], "license": "MIT", "bin": { - "uuid": "dist/bin/uuid" + "uuid": "dist/esm/bin/uuid" } }, "node_modules/istanbul-lib-report": { @@ -10481,7 +10418,9 @@ } }, "node_modules/mocha": { - "version": "11.7.6", + "version": "11.8.0", + "resolved": "https://registry.npmjs.org/mocha/-/mocha-11.8.0.tgz", + "integrity": "sha512-VyCeUdGN3A9lmCTTgG4yuvY9ixxaDk+xt2R/7/+1AP6EqNG+G9OKkzBwhVtVYoNX8YsxNSgAl8mOv3IAeOpFbw==", "dev": true, "license": "MIT", "dependencies": { @@ -11754,14 +11693,6 @@ "dev": true, "license": "MIT" }, - "node_modules/randombytes": { - "version": "2.1.0", - "dev": true, - "license": "MIT", - "dependencies": { - "safe-buffer": "^5.1.0" - } - }, "node_modules/range-parser": { "version": "1.2.1", "license": "MIT", @@ -12396,11 +12327,13 @@ } }, "node_modules/serialize-javascript": { - "version": "6.0.2", + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.0.tgz", + "integrity": "sha512-RNEqWOyhhUQYN9V1GfHwu9AR/g+NTciH6Z5u3/no6X3/w+04J2lVDL+svFQVXgXrEGBMG2puMVN3gq2SNGuTGw==", "dev": true, "license": "BSD-3-Clause", - "dependencies": { - "randombytes": "^2.1.0" + "engines": { + "node": ">=20.0.0" } }, "node_modules/serve-static": { @@ -12906,11 +12839,6 @@ "dev": true, "license": "CC0-1.0" }, - "node_modules/sprintf-js": { - "version": "1.0.3", - "dev": true, - "license": "BSD-3-Clause" - }, "node_modules/stable-hash": { "version": "0.0.5", "dev": true, @@ -13209,20 +13137,6 @@ "node": ">=8" } }, - "node_modules/test-exclude/node_modules/balanced-match": { - "version": "1.0.2", - "dev": true, - "license": "MIT" - }, - "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "1.1.16", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/test-exclude/node_modules/minimatch": { "version": "3.1.5", "dev": true, @@ -13469,14 +13383,6 @@ } } }, - "node_modules/ts-node/node_modules/diff": { - "version": "4.0.4", - "dev": true, - "license": "BSD-3-Clause", - "engines": { - "node": ">=0.3.1" - } - }, "node_modules/tsconfig-paths": { "version": "3.15.0", "dev": true, @@ -13883,17 +13789,6 @@ "node": ">= 0.4.0" } }, - "node_modules/uuid": { - "version": "14.0.1", - "funding": [ - "https://github.com/sponsors/broofa", - "https://github.com/sponsors/ctavan" - ], - "license": "MIT", - "bin": { - "uuid": "dist-node/bin/uuid" - } - }, "node_modules/v8-compile-cache-lib": { "version": "3.0.1", "dev": true, diff --git a/package.json b/package.json old mode 100755 new mode 100644 index a120374..e42381c --- a/package.json +++ b/package.json @@ -127,7 +127,11 @@ }, "minimatch@5.1.9": { "brace-expansion": "^2.1.4" - } + }, + "serialize-javascript": "^7.1.0", + "uuid": "^11.1.1", + "diff": "^8.0.3", + "brace-expansion@1": "^1.1.18" }, "engines": { "node": ">=22.0.0"