From 245fc101aaaa3d1188ad0003e7642e6e223dc6ae Mon Sep 17 00:00:00 2001 From: Kyle Tully Date: Wed, 30 Sep 2026 15:59:17 -0400 Subject: [PATCH] fix: raise eight stale pnpm override floors to clear 27 advisories The overrides block encodes a MINIMUM version per package. Upstreams have each shipped incremental follow-up fixes since these floors were written, so half of them had gone stale and resolved to versions that are vulnerable again. pnpm audit reported 29 advisories across five packages. Floors raised (resolved version in parentheses): - axios >=1.18.0 -> >=1.20.0 (1.20.0) clears 12 advisories - undici@6 >=6.28.0 -> >=6.28.1 (6.29.0) - undici@7 >=7.29.0 -> >=7.29.1 (7.30.0) picks up ~10 CVEs - js-yaml@4 >=4.3.1 -> >=4.3.2 (4.3.2) - ip-address >=10.4.0 -> >=10.5.1 (10.7.2) - brace-expansion@1 >=1.1.16 -> >=1.1.21 (1.1.21) - brace-expansion@2 >=2.1.2 -> >=2.1.7 (2.1.7) - brace-expansion@5 >=5.0.7 -> >=5.0.12 (5.0.12) This is alert hygiene, not remediation of exploitable exposure. Every one of these is a dev/build-time transitive dependency, and files is ["dist"], so no consumer of the published package is affected by any of them. Each was checked for reachability and none is reachable on a code path this repo executes: the ip-address bug is in a classifier and its only consumer (socks) never calls one; the undici bug is in the WebSocket deflate inflater and nothing here opens a WebSocket; js-yaml runs during lint but only parses our own config, and there is no .eslintrc.y*ml. Floors resolve to the newest match, so this lands minors (6.29.0, 7.30.0, 10.7.2, 1.20.0) rather than bare patches. Each was diff-reviewed as additive/fix-only. Two behavior changes exist but are unreachable here: js-yaml 4.3.2 adds a 100-item merge-sequence cap, and ip-address 10.6.0 tightened classifier semantics. Re-locked with `pnpm install`, deliberately NOT `pnpm update`: @n8n/node-cli and n8n-workflow are declared "*", so a broad update floats the toolchain (0.34.0 -> 0.50.3, ~1982 lockfile lines). Changing an override instead re-resolves only the affected subtree. @n8n/node-cli remains 0.34.0. pnpm audit now reports only the two vitest advisories, which need a major bump and are handled separately. Build, lint and tests are green. --- package.json | 16 ++++----- pnpm-lock.yaml | 94 +++++++++++++++++++++++++------------------------- 2 files changed, 55 insertions(+), 55 deletions(-) diff --git a/package.json b/package.json index 67bdce5..27a7563 100644 --- a/package.json +++ b/package.json @@ -61,19 +61,19 @@ "pnpm": { "overrides": { "esbuild": ">=0.28.1", - "undici@6": ">=6.28.0 <7", - "undici@7": ">=7.29.0 <8", + "undici@6": ">=6.28.1 <7", + "undici@7": ">=7.29.1 <8", "uuid@10": "11.1.1", "lodash@<4.18.0": "4.18.1", "minimatch@9": "9.0.7", "form-data@4": "4.0.6", - "axios": ">=1.18.0 <2", + "axios": ">=1.20.0 <2", "postcss": ">=8.5.23 <9", - "js-yaml@4": ">=4.3.1 <5", - "ip-address": ">=10.4.0 <11", - "brace-expansion@1": ">=1.1.16 <2", - "brace-expansion@2": ">=2.1.2 <3", - "brace-expansion@5": ">=5.0.7 <6", + "js-yaml@4": ">=4.3.2 <5", + "ip-address": ">=10.5.1 <11", + "brace-expansion@1": ">=1.1.21 <2", + "brace-expansion@2": ">=2.1.7 <3", + "brace-expansion@5": ">=5.0.12 <6", "nanoid@3": ">=3.3.18 <4" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7044a23..7b8a244 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,19 +6,19 @@ settings: overrides: esbuild: '>=0.28.1' - undici@6: '>=6.28.0 <7' - undici@7: '>=7.29.0 <8' + undici@6: '>=6.28.1 <7' + undici@7: '>=7.29.1 <8' uuid@10: 11.1.1 lodash@<4.18.0: 4.18.1 minimatch@9: 9.0.7 form-data@4: 4.0.6 - axios: '>=1.18.0 <2' + axios: '>=1.20.0 <2' postcss: '>=8.5.23 <9' - js-yaml@4: '>=4.3.1 <5' - ip-address: '>=10.4.0 <11' - brace-expansion@1: '>=1.1.16 <2' - brace-expansion@2: '>=2.1.2 <3' - brace-expansion@5: '>=5.0.7 <6' + js-yaml@4: '>=4.3.2 <5' + ip-address: '>=10.5.1 <11' + brace-expansion@1: '>=1.1.21 <2' + brace-expansion@2: '>=2.1.7 <3' + brace-expansion@5: '>=5.0.12 <6' nanoid@3: '>=3.3.18 <4' importers: @@ -1587,8 +1587,8 @@ packages: resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==} engines: {node: '>= 0.4'} - axios@1.19.0: - resolution: {integrity: sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==} + axios@1.20.0: + resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==} balanced-match@1.0.2: resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} @@ -1611,14 +1611,14 @@ packages: resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==} engines: {node: '>=8'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -2289,8 +2289,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.5.0: - resolution: {integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==} + ip-address@10.7.2: + resolution: {integrity: sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==} engines: {node: '>= 12'} is-arguments@1.2.0: @@ -2421,8 +2421,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true json-buffer@3.0.1: @@ -2979,7 +2979,7 @@ packages: resolution: {integrity: sha512-pOLi+Gdll3JekwuFjXO3fTq+L9lzMQGcSq7M5gIjExcl3Gu1hd4XXuf5o3+LuSBsaULQH7DiNbsqPd1chVpQGQ==} engines: {node: '>=10.7.0'} peerDependencies: - axios: '>=1.18.0 <2' + axios: '>=1.20.0 <2' retry@0.13.1: resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==} @@ -3242,12 +3242,12 @@ packages: undici-types@5.26.5: resolution: {integrity: sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==} - undici@6.28.0: - resolution: {integrity: sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==} + undici@6.29.0: + resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} engines: {node: '>=18.17'} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} universal-user-agent@7.0.3: @@ -3648,7 +3648,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -3815,7 +3815,7 @@ snapshots: '@langchain/openai': 1.4.1(@langchain/core@1.1.41(openai@6.42.0(ws@8.21.0)(zod@3.25.67))(ws@8.21.0))(ws@8.21.0) '@langchain/textsplitters': 1.0.1(@langchain/core@1.1.41(openai@6.42.0(ws@8.21.0)(zod@3.25.67))(ws@8.21.0)) handlebars: 4.7.9 - js-yaml: 4.3.1 + js-yaml: 4.3.2 jsonpointer: 5.0.1 openapi-types: 12.1.3 uuid: 11.1.1 @@ -3840,7 +3840,7 @@ snapshots: binary-extensions: 2.3.0 flat: 5.0.2 ibm-cloud-sdk-core: 5.4.20 - js-yaml: 4.3.1 + js-yaml: 4.3.2 langsmith: 0.7.7(openai@6.42.0(ws@8.21.0)(zod@3.25.67))(ws@8.21.0) math-expression-evaluator: 2.0.7 openai: 6.42.0(ws@8.21.0)(zod@3.25.67) @@ -4086,7 +4086,7 @@ snapshots: pdf-parse: 2.4.5 proxy-from-env: 1.1.0 tmp-promise: 3.0.3 - undici: 6.28.0 + undici: 6.29.0 zod: 3.25.67 zod-to-json-schema: 3.23.3(zod@3.25.67) transitivePeerDependencies: @@ -5052,7 +5052,7 @@ snapshots: dependencies: possible-typed-array-names: 1.1.0 - axios@1.19.0(debug@4.3.4): + axios@1.20.0(debug@4.3.4): dependencies: follow-redirects: 1.16.0(debug@4.3.4) form-data: 4.0.6 @@ -5074,16 +5074,16 @@ snapshots: binary-extensions@2.3.0: {} - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -5763,7 +5763,7 @@ snapshots: '@types/debug': 4.1.12 '@types/node': 18.19.80 '@types/tough-cookie': 4.0.0 - axios: 1.19.0(debug@4.3.4) + axios: 1.20.0(debug@4.3.4) camelcase: 6.3.0 debug: 4.3.4 dotenv: 16.4.5 @@ -5774,7 +5774,7 @@ snapshots: jsonwebtoken: 9.0.3 load-esm: 1.0.3 mime-types: 2.1.35 - retry-axios: 2.6.0(axios@1.19.0(debug@4.3.4)) + retry-axios: 2.6.0(axios@1.20.0) tough-cookie: 4.1.3 transitivePeerDependencies: - supports-color @@ -5802,7 +5802,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.5.0: {} + ip-address@10.7.2: {} is-arguments@1.2.0: dependencies: @@ -5917,7 +5917,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -6085,19 +6085,19 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.7: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -6448,7 +6448,7 @@ snapshots: proxy-agent: 7.0.0 semver: 7.7.4 tinyglobby: 0.2.15 - undici: 7.29.0 + undici: 7.30.0 url-join: 5.0.0 wildcard-match: 5.1.4 yargs-parser: 22.0.0 @@ -6470,9 +6470,9 @@ snapshots: onetime: 7.0.0 signal-exit: 4.1.0 - retry-axios@2.6.0(axios@1.19.0(debug@4.3.4)): + retry-axios@2.6.0(axios@1.20.0): dependencies: - axios: 1.19.0(debug@4.3.4) + axios: 1.20.0(debug@4.3.4) retry@0.13.1: {} @@ -6577,7 +6577,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.5.0 + ip-address: 10.7.2 smart-buffer: 4.2.0 source-map-js@1.2.1: {} @@ -6727,9 +6727,9 @@ snapshots: undici-types@5.26.5: {} - undici@6.28.0: {} + undici@6.29.0: {} - undici@7.29.0: {} + undici@7.30.0: {} universal-user-agent@7.0.3: {}