Huang Xin
353d381427
Raise the pnpm-workspace transitive overrides to the patched versions: - undici >=7.24.0 -> >=7.28.0 <8 (resolves to 7.28.0). Fixes 7 advisories: WebSocket DoS, SOCKS5 cross-origin routing, SOCKS5 TLS bypass, Set-Cookie header injection, shared-cache info disclosure, response queue poisoning, and SameSite downgrade (GHSA undici < 7.28.0). Bounded below 8 to stay on the patched 7.x line and avoid an unvetted major bump (an open-ended range pulled undici 8.5.0). - dompurify >=3.4.9 -> >=3.4.11 (resolves to 3.4.11). Fixes permanent ALLOWED_ATTR pollution via setConfig() (<= 3.4.10). Verified: pnpm test, pnpm lint, pnpm build-web all pass; lockfile sweep confirms no vulnerable undici/dompurify versions remain. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
packages:
|
|
- apps/*
|
|
- apps/readest-app/workers/send-email
|
|
- apps/readest-app/extensions/*
|
|
- packages/foliate-js
|
|
|
|
allowBuilds:
|
|
core-js: true
|
|
edgedriver: true
|
|
esbuild: true
|
|
geckodriver: true
|
|
protobufjs: true
|
|
sharp: true
|
|
workerd: true
|
|
|
|
onlyBuiltDependencies:
|
|
- sharp
|
|
|
|
patchedDependencies:
|
|
'@ai-sdk/provider-utils@3.0.25': patches/@ai-sdk__provider-utils@3.0.25.patch
|
|
'@ai-sdk/provider-utils@4.0.27': patches/@ai-sdk__provider-utils@4.0.27.patch
|
|
mdast-util-gfm-autolink-literal@2.0.1: patches/mdast-util-gfm-autolink-literal@2.0.1.patch
|
|
|
|
overrides:
|
|
glob: '>=11.1.0'
|
|
jws: '>=4.0.1'
|
|
vite: '>=7.3.5 <8'
|
|
esbuild: '>=0.28.1 <0.29'
|
|
srvx: '>=0.11.13'
|
|
rollup: '>=4.59.0'
|
|
undici: '>=7.28.0 <8'
|
|
flatted: '>=3.4.2'
|
|
body-parser: '>=2.2.1'
|
|
dompurify: '>=3.4.11'
|
|
i18next-http-backend: '>=3.0.5'
|
|
picomatch: '>=4.0.4'
|
|
path-to-regexp: '>=8.4.0'
|
|
protobufjs: '>=7.6.3 <8'
|
|
serialize-javascript: 7.0.5
|
|
fast-xml-parser: '>=5.7.0'
|
|
lodash: '>=4.18.0'
|
|
lodash-es: '>=4.18.0'
|
|
postcss: 8.5.14
|
|
basic-ftp: '>=5.3.0'
|
|
qs: '>=6.15.2'
|
|
shell-quote: '>=1.8.4'
|
|
form-data: '>=4.0.6'
|
|
js-yaml: '>=4.2.0'
|
|
'@opentelemetry/core': '>=2.8.0'
|
|
'@babel/runtime': '>=7.26.10'
|
|
'@babel/helpers': '>=7.26.10'
|
|
'@babel/core': '>=7.29.6'
|
|
mdast-util-gfm-autolink-literal: 2.0.1
|
|
uuid: '>=14.0.0'
|
|
ws: '>=8.21.0'
|
|
'@emnapi/core': 1.8.1
|
|
'@emnapi/runtime': 1.8.1
|