From 1eaa70193d0ddd65a8b34fe67584dbeabdda74a2 Mon Sep 17 00:00:00 2001 From: Rainer Killinger Date: Wed, 26 Aug 2026 14:59:47 +0200 Subject: [PATCH] fix: update critical production dependencies --- pnpm-lock.yaml | 70 +++++++++++++-------------------------------- pnpm-workspace.yaml | 8 ++++++ 2 files changed, 28 insertions(+), 50 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b5205396..3cb30e87 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,10 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + handlebars@>=4.0.0 <=4.7.8: '>=4.7.9' + tar@<=7.5.18: '>=7.5.19' + pnpmfileChecksum: sha256-97djGzv9LU819ru7JavDNwxjBxa692PveFwWYet5Sbg= importers: @@ -5851,10 +5855,6 @@ packages: chownr@1.1.4: resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==} - chownr@2.0.0: - resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==} - engines: {node: '>=10'} - chownr@3.0.0: resolution: {integrity: sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==} engines: {node: '>=18'} @@ -7415,10 +7415,6 @@ packages: resolution: {integrity: sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==} engines: {node: '>=10'} - fs-minipass@2.1.0: - resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==} - engines: {node: '>= 8'} - fs-minipass@3.0.3: resolution: {integrity: sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==} engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0} @@ -7636,8 +7632,8 @@ packages: handle-thing@2.0.1: resolution: {integrity: sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==} - handlebars@4.7.8: - resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==} + handlebars@4.7.9: + resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==} engines: {node: '>=0.4.7'} hasBin: true @@ -9090,10 +9086,6 @@ packages: resolution: {integrity: sha512-fNzuVyifolSLFL4NzpF+wEF4qrgqaaKX0haXPQEdQ7NKAN+WecoKMHV09YcuL/DHxrUsYQOK3MiuDf7Ip2OXfQ==} engines: {node: '>=8'} - minipass@5.0.0: - resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==} - engines: {node: '>=8'} - minipass@7.1.2: resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==} engines: {node: '>=16 || 14 >=14.17'} @@ -11098,13 +11090,8 @@ packages: tar-stream@3.1.8: resolution: {integrity: sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ==} - tar@6.2.1: - resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} - engines: {node: '>=10'} - deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - - tar@7.5.11: - resolution: {integrity: sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==} + tar@7.5.22: + resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} tarr@1.1.0: @@ -13933,7 +13920,7 @@ snapshots: prompts: 2.4.2 rimraf: 4.4.1 semver: 7.6.0 - tar: 6.2.1 + tar: 7.5.22 tslib: 2.6.2 xml2js: 0.5.0 transitivePeerDependencies: @@ -13955,7 +13942,7 @@ snapshots: prompts: 2.4.2 rimraf: 6.1.3 semver: 7.7.4 - tar: 7.5.11 + tar: 7.5.22 tslib: 2.8.1 xml2js: 0.6.2 transitivePeerDependencies: @@ -14207,7 +14194,7 @@ snapshots: fast-glob: 3.3.3 fs-extra: 11.3.4 glob: 10.5.0 - handlebars: 4.7.8 + handlebars: 4.7.9 html-entities: 2.6.0 i18next: 23.16.8 json5: 2.2.3 @@ -14840,7 +14827,7 @@ snapshots: ssh-config: 1.1.6 stream-combiner2: 1.1.1 superagent: 9.0.2 - tar: 6.2.1 + tar: 7.5.22 tslib: 2.6.2 transitivePeerDependencies: - supports-color @@ -16952,7 +16939,7 @@ snapshots: minipass-pipeline: 1.2.4 p-map: 4.0.0 ssri: 10.0.6 - tar: 6.2.1 + tar: 7.5.22 unique-filename: 3.0.0 cacheable-lookup@7.0.0: {} @@ -17105,8 +17092,6 @@ snapshots: chownr@1.1.4: {} - chownr@2.0.0: {} - chownr@3.0.0: {} chrome-trace-event@1.0.4: {} @@ -17391,7 +17376,7 @@ snapshots: dependencies: conventional-commits-filter: 2.0.7 dateformat: 3.0.3 - handlebars: 4.7.8 + handlebars: 4.7.9 json-stringify-safe: 5.0.1 lodash: 4.17.21 meow: 8.1.2 @@ -19057,10 +19042,6 @@ snapshots: jsonfile: 6.2.0 universalify: 2.0.1 - fs-minipass@2.1.0: - dependencies: - minipass: 3.3.6 - fs-minipass@3.0.3: dependencies: minipass: 7.1.3 @@ -19316,7 +19297,7 @@ snapshots: handle-thing@2.0.1: {} - handlebars@4.7.8: + handlebars@4.7.9: dependencies: minimist: 1.2.8 neo-async: 2.6.2 @@ -20986,7 +20967,7 @@ snapshots: minipass-fetch@3.0.5: dependencies: - minipass: 7.1.2 + minipass: 7.1.3 minipass-sized: 1.0.3 minizlib: 2.1.2 optionalDependencies: @@ -21010,8 +20991,6 @@ snapshots: minipass@4.2.8: {} - minipass@5.0.0: {} - minipass@7.1.2: {} minipass@7.1.3: {} @@ -21294,7 +21273,7 @@ snapshots: nopt: 7.2.1 proc-log: 4.2.0 semver: 7.7.4 - tar: 6.2.1 + tar: 7.5.22 which: 4.0.0 transitivePeerDependencies: - supports-color @@ -21641,7 +21620,7 @@ snapshots: promise-retry: 2.0.1 sigstore: 2.3.1 ssri: 10.0.6 - tar: 6.2.1 + tar: 7.5.22 transitivePeerDependencies: - bluebird - supports-color @@ -23421,16 +23400,7 @@ snapshots: - bare-buffer - react-native-b4a - tar@6.2.1: - dependencies: - chownr: 2.0.0 - fs-minipass: 2.1.0 - minipass: 5.0.0 - minizlib: 2.1.2 - mkdirp: 1.0.4 - yallist: 4.0.0 - - tar@7.5.11: + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -23842,7 +23812,7 @@ snapshots: typedoc@0.18.0(typescript@3.8.3): dependencies: fs-extra: 9.1.0 - handlebars: 4.7.8 + handlebars: 4.7.9 highlight.js: 10.7.3 lodash: 4.17.21 lunr: 2.3.9 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 19cacd89..b6f56355 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -6,6 +6,10 @@ packages: - packages/* - images/* +auditConfig: + ignoreGhsas: + - GHSA-hmx5-qpq5-p643 + forceLegacyDeploy: true onlyBuiltDependencies: @@ -20,3 +24,7 @@ onlyBuiltDependencies: - sharp - ssh2 - swiper + +overrides: + handlebars@>=4.0.0 <=4.7.8: '>=4.7.9' + tar@<=7.5.18: '>=7.5.19' \ No newline at end of file