From 04b7097125791346c8dc37aa59999b44078dcd2c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 15:11:13 +0000 Subject: [PATCH 1/7] Fix shell-quote vulnerability Co-authored-by: Meril --- pnpm-lock.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 06ab075..f210b25 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2559,8 +2559,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.3: - resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} shiki@0.14.7: @@ -3683,7 +3683,7 @@ snapshots: listr2: 4.0.5(enquirer@2.4.1) log-symbols: 4.1.0 micromatch: 4.0.8 - shell-quote: 1.8.3 + shell-quote: 1.8.4 string-env-interpolation: 1.0.1 ts-log: 2.2.7 tslib: 2.8.1 @@ -5705,7 +5705,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.3: {} + shell-quote@1.8.4: {} shiki@0.14.7: dependencies: From 59a5339c024e10982ca58321e411478b1d542a9d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 15:18:05 +0000 Subject: [PATCH 2/7] Fix ws vulnerability Co-authored-by: Meril --- package.json | 5 +++++ pnpm-lock.yaml | 45 +++++++++++++++------------------------------ 2 files changed, 20 insertions(+), 30 deletions(-) diff --git a/package.json b/package.json index d80d2c3..56e2071 100644 --- a/package.json +++ b/package.json @@ -50,5 +50,10 @@ "graphql": "^16.6.0", "lodash.get": "^4.4.2", "zod": "3.22.4" + }, + "pnpm": { + "overrides": { + "ws": "8.21.0" + } } } \ No newline at end of file diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f210b25..145c026 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + ws: 8.21.0 + importers: .: @@ -2043,7 +2046,7 @@ packages: isomorphic-ws@5.0.0: resolution: {integrity: sha512-muId7Zzn9ywDsyXgTIafTry2sV3nySZeUDe6YedVd1Hvuuep5AsIlqK+XefWpYTyJG5e503F2xIuT2lcU6rCSw==} peerDependencies: - ws: '*' + ws: 8.21.0 jiti@1.17.1: resolution: {integrity: sha512-NZIITw8uZQFuzQimqjUxIrIcEdxYDFIe/0xYfIlVXTkiBjjyBEvgasj5bb0/cHtPRD/NziPbT312sFrkI5ALpw==} @@ -2892,20 +2895,8 @@ packages: wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} - ws@8.13.0: - resolution: {integrity: sha512-x9vcZYTrFPC7aSIbj7sRCYo7L/Xb8Iy+pW0ng0wt2vCJv7M9HOMy0UoN3rr+IFC7hb7vXoqS+P9ktyLLLhO+LA==} - engines: {node: '>=10.0.0'} - peerDependencies: - bufferutil: ^4.0.1 - utf-8-validate: '>=5.0.2' - peerDependenciesMeta: - bufferutil: - optional: true - utf-8-validate: - optional: true - - ws@8.18.3: - resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==} + ws@8.21.0: + resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -3836,9 +3827,9 @@ snapshots: '@types/ws': 8.18.1 graphql: 16.11.0 graphql-ws: 5.12.1(graphql@16.11.0) - isomorphic-ws: 5.0.0(ws@8.13.0) + isomorphic-ws: 5.0.0(ws@8.21.0) tslib: 2.8.1 - ws: 8.13.0 + ws: 8.21.0 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -3862,9 +3853,9 @@ snapshots: '@graphql-tools/utils': 9.2.1(graphql@16.11.0) '@types/ws': 8.18.1 graphql: 16.11.0 - isomorphic-ws: 5.0.0(ws@8.13.0) + isomorphic-ws: 5.0.0(ws@8.21.0) tslib: 2.8.1 - ws: 8.13.0 + ws: 8.21.0 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -4021,10 +4012,10 @@ snapshots: '@types/ws': 8.18.1 '@whatwg-node/fetch': 0.8.8 graphql: 16.11.0 - isomorphic-ws: 5.0.0(ws@8.18.3) + isomorphic-ws: 5.0.0(ws@8.21.0) tslib: 2.8.1 value-or-promise: 1.0.12 - ws: 8.18.3 + ws: 8.21.0 transitivePeerDependencies: - '@types/node' - bufferutil @@ -5190,13 +5181,9 @@ snapshots: isexe@2.0.0: {} - isomorphic-ws@5.0.0(ws@8.13.0): + isomorphic-ws@5.0.0(ws@8.21.0): dependencies: - ws: 8.13.0 - - isomorphic-ws@5.0.0(ws@8.18.3): - dependencies: - ws: 8.18.3 + ws: 8.21.0 jiti@1.17.1: {} @@ -6017,9 +6004,7 @@ snapshots: wrappy@1.0.2: {} - ws@8.13.0: {} - - ws@8.18.3: {} + ws@8.21.0: {} y18n@4.0.3: {} From 792c3942bc70c47e6017c03016a3f34e9655feb8 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 15:47:28 +0000 Subject: [PATCH 3/7] Fix rollup vulnerability Co-authored-by: Meril --- package.json | 2 +- pnpm-lock.yaml | 36 ++++++++++++++++++------------------ 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/package.json b/package.json index 56e2071..4fe2150 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,7 @@ "@types/node": "^22.7.2", "esbuild": "^0.17.18", "json-schema-to-typescript": "^13.1.2", - "rollup": "^3.21.5", + "rollup": "^3.30.0", "rollup-plugin-dts": "^5.3.0", "rollup-plugin-esbuild": "^5.0.0", "typedoc": "^0.25.12", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 145c026..d0cd2fa 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -56,7 +56,7 @@ importers: version: 3.0.4(graphql@16.11.0) '@rollup/plugin-json': specifier: ^6.1.0 - version: 6.1.0(rollup@3.29.5) + version: 6.1.0(rollup@3.30.0) '@types/lodash.get': specifier: ^4.4.9 version: 4.4.9 @@ -70,14 +70,14 @@ importers: specifier: ^13.1.2 version: 13.1.2 rollup: - specifier: ^3.21.5 - version: 3.29.5 + specifier: ^3.30.0 + version: 3.30.0 rollup-plugin-dts: specifier: ^5.3.0 - version: 5.3.1(rollup@3.29.5)(typescript@5.8.3) + version: 5.3.1(rollup@3.30.0)(typescript@5.8.3) rollup-plugin-esbuild: specifier: ^5.0.0 - version: 5.0.0(esbuild@0.17.19)(rollup@3.29.5) + version: 5.0.0(esbuild@0.17.19)(rollup@3.30.0) typedoc: specifier: ^0.25.12 version: 0.25.13(typescript@5.8.3) @@ -2503,8 +2503,8 @@ packages: esbuild: '>=0.10.1' rollup: ^1.20.0 || ^2.0.0 || ^3.0.0 - rollup@3.29.5: - resolution: {integrity: sha512-GVsDdsbJzzy4S/v3dqWPJ7EfvZJfCHiDqe80IyrF59LYuP+e6U1LJoUqeuqRbwAWoMNoXivMNeNAOf5E22VA1w==} + rollup@3.30.0: + resolution: {integrity: sha512-kQvGasUgN+AlWGliFn2POSajRQEsULVYFGTvOZmK06d7vCD+YhZztt70kGk3qaeAXeWYL5eO7zx+rAubBc55eA==} engines: {node: '>=14.18.0', npm: '>=8.0.0'} hasBin: true @@ -4175,19 +4175,19 @@ snapshots: '@repeaterjs/repeater@3.0.6': {} - '@rollup/plugin-json@6.1.0(rollup@3.29.5)': + '@rollup/plugin-json@6.1.0(rollup@3.30.0)': dependencies: - '@rollup/pluginutils': 5.2.0(rollup@3.29.5) + '@rollup/pluginutils': 5.2.0(rollup@3.30.0) optionalDependencies: - rollup: 3.29.5 + rollup: 3.30.0 - '@rollup/pluginutils@5.2.0(rollup@3.29.5)': + '@rollup/pluginutils@5.2.0(rollup@3.30.0)': dependencies: '@types/estree': 1.0.8 estree-walker: 2.0.2 picomatch: 4.0.4 optionalDependencies: - rollup: 3.29.5 + rollup: 3.30.0 '@rollup/rollup-android-arm-eabi@4.61.1': optional: true @@ -5592,27 +5592,27 @@ snapshots: rfdc@1.4.1: {} - rollup-plugin-dts@5.3.1(rollup@3.29.5)(typescript@5.8.3): + rollup-plugin-dts@5.3.1(rollup@3.30.0)(typescript@5.8.3): dependencies: magic-string: 0.30.17 - rollup: 3.29.5 + rollup: 3.30.0 typescript: 5.8.3 optionalDependencies: '@babel/code-frame': 7.27.1 - rollup-plugin-esbuild@5.0.0(esbuild@0.17.19)(rollup@3.29.5): + rollup-plugin-esbuild@5.0.0(esbuild@0.17.19)(rollup@3.30.0): dependencies: - '@rollup/pluginutils': 5.2.0(rollup@3.29.5) + '@rollup/pluginutils': 5.2.0(rollup@3.30.0) debug: 4.4.1 es-module-lexer: 1.7.0 esbuild: 0.17.19 joycon: 3.1.1 jsonc-parser: 3.3.1 - rollup: 3.29.5 + rollup: 3.30.0 transitivePeerDependencies: - supports-color - rollup@3.29.5: + rollup@3.30.0: optionalDependencies: fsevents: 2.3.3 From e50af6e6e9b3d9bf60617b107facda32b9cb463c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 16:00:25 +0000 Subject: [PATCH 4/7] Fix immutable vulnerability Co-authored-by: Meril --- package.json | 1 + pnpm-lock.yaml | 11 ++++++----- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 4fe2150..46bd8d7 100644 --- a/package.json +++ b/package.json @@ -53,6 +53,7 @@ }, "pnpm": { "overrides": { + "immutable": "3.8.3", "ws": "8.21.0" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d0cd2fa..0d79722 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + immutable: 3.8.3 ws: 8.21.0 importers: @@ -1951,9 +1952,9 @@ packages: resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==} engines: {node: '>= 4'} - immutable@3.7.6: - resolution: {integrity: sha512-AizQPcaofEtO11RZhPPHBOJRdo/20MKQF9mBLnVkBoyHi1/zXK8fzVdnEpSV9gxqtnh6Qomfp3F0xT5qP/vThw==} - engines: {node: '>=0.8.0'} + immutable@3.8.3: + resolution: {integrity: sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==} + engines: {node: '>=0.10.0'} import-fresh@3.3.1: resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==} @@ -2968,7 +2969,7 @@ snapshots: fbjs: 3.0.5 glob: 7.2.3 graphql: 16.11.0 - immutable: 3.7.6 + immutable: 3.8.3 invariant: 2.2.4 nullthrows: 1.1.1 relay-runtime: 12.0.0 @@ -5092,7 +5093,7 @@ snapshots: ignore@5.3.2: {} - immutable@3.7.6: {} + immutable@3.8.3: {} import-fresh@3.3.1: dependencies: From 457973805add968cac1883beb670855c7079f1f6 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 16:39:08 +0000 Subject: [PATCH 5/7] Fix lodash vulnerability Co-authored-by: Meril --- package.json | 1 + pnpm-lock.yaml | 15 ++++++++------- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 46bd8d7..0d01d72 100644 --- a/package.json +++ b/package.json @@ -54,6 +54,7 @@ "pnpm": { "overrides": { "immutable": "3.8.3", + "lodash": "4.18.1", "ws": "8.21.0" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0d79722..87954ab 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,7 @@ settings: overrides: immutable: 3.8.3 + lodash: 4.18.1 ws: 8.21.0 importers: @@ -2139,8 +2140,8 @@ packages: lodash.startcase@4.4.0: resolution: {integrity: sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg==} - lodash@4.17.21: - resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==} + lodash@4.18.1: + resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} log-symbols@4.1.0: resolution: {integrity: sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==} @@ -3706,7 +3707,7 @@ snapshots: common-tags: 1.8.2 graphql: 16.11.0 import-from: 4.0.0 - lodash: 4.17.21 + lodash: 4.18.1 tslib: 2.5.3 '@graphql-codegen/schema-ast@3.0.1(graphql@16.11.0)': @@ -3972,7 +3973,7 @@ snapshots: jose: 4.15.9 js-yaml: 4.1.0 json-stable-stringify: 1.3.0 - lodash: 4.17.21 + lodash: 4.18.1 scuid: 1.1.0 tslib: 2.8.1 yaml-ast-parser: 0.0.43 @@ -5119,7 +5120,7 @@ snapshots: cli-width: 3.0.0 external-editor: 3.1.0 figures: 3.2.0 - lodash: 4.17.21 + lodash: 4.18.1 mute-stream: 0.0.8 ora: 5.4.1 run-async: 2.4.1 @@ -5222,7 +5223,7 @@ snapshots: glob: 7.2.3 glob-promise: 4.2.2(glob@7.2.3) is-glob: 4.0.3 - lodash: 4.17.21 + lodash: 4.18.1 minimist: 1.2.8 mkdirp: 1.0.4 mz: 2.7.0 @@ -5276,7 +5277,7 @@ snapshots: lodash.startcase@4.4.0: {} - lodash@4.17.21: {} + lodash@4.18.1: {} log-symbols@4.1.0: dependencies: From 1abcac13ddbbf759b024381f9ab1800dec3e6fa0 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 16:41:35 +0000 Subject: [PATCH 6/7] Fix tmp vulnerability Co-authored-by: Meril --- package.json | 1 + pnpm-lock.yaml | 19 ++++++------------- 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/package.json b/package.json index 0d01d72..1b9f32e 100644 --- a/package.json +++ b/package.json @@ -55,6 +55,7 @@ "overrides": { "immutable": "3.8.3", "lodash": "4.18.1", + "tmp": "0.2.7", "ws": "8.21.0" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 87954ab..a377006 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: immutable: 3.8.3 lodash: 4.18.1 + tmp: 0.2.7 ws: 8.21.0 importers: @@ -2308,10 +2309,6 @@ packages: resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==} engines: {node: '>=10'} - os-tmpdir@1.0.2: - resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==} - engines: {node: '>=0.10.0'} - outdent@0.5.0: resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==} @@ -2693,9 +2690,9 @@ packages: title-case@3.0.3: resolution: {integrity: sha512-e1zGYRvbffpcHIrnuqT0Dh+gEJtDaxDSoG4JAIpq4oDFyooziLBIiYQv0GBT4FUAnUop5uZ1hiIAj7oAF6sOCA==} - tmp@0.0.33: - resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==} - engines: {node: '>=0.6.0'} + tmp@0.2.7: + resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==} + engines: {node: '>=14.14'} to-regex-range@5.0.1: resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==} @@ -4875,7 +4872,7 @@ snapshots: dependencies: chardet: 0.7.0 iconv-lite: 0.4.24 - tmp: 0.0.33 + tmp: 0.2.7 extract-files@11.0.0: {} @@ -5434,8 +5431,6 @@ snapshots: strip-ansi: 6.0.1 wcwidth: 1.0.1 - os-tmpdir@1.0.2: {} - outdent@0.5.0: {} p-filter@2.1.0: @@ -5815,9 +5810,7 @@ snapshots: dependencies: tslib: 2.5.3 - tmp@0.0.33: - dependencies: - os-tmpdir: 1.0.2 + tmp@0.2.7: {} to-regex-range@5.0.1: dependencies: From 0cb1956ca5a5a52b45c4e1f78036b2318cc13f51 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 16:43:58 +0000 Subject: [PATCH 7/7] Fix fast-uri vulnerability Co-authored-by: Meril --- pnpm-lock.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a377006..f3bc649 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1779,8 +1779,8 @@ packages: fast-querystring@1.1.2: resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==} - fast-uri@3.0.6: - resolution: {integrity: sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==} + fast-uri@3.1.2: + resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} fast-url-parser@1.1.3: resolution: {integrity: sha512-5jOCVXADYNuRkKFzNJ0dCCewsZiYo0dz8QNYljkOpFC6r2U4OBmKtvm/Tsuh4w1YYdDqDb31a8TVhBJ2OJKdqQ==} @@ -4385,7 +4385,7 @@ snapshots: ajv@8.17.1: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.0.6 + fast-uri: 3.1.2 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4892,7 +4892,7 @@ snapshots: dependencies: fast-decode-uri-component: 1.0.1 - fast-uri@3.0.6: {} + fast-uri@3.1.2: {} fast-url-parser@1.1.3: dependencies: