mirror of
https://github.com/zitadel/zitadel.git
synced 2026-08-19 01:14:48 -05:00
Max Peintner
b27fdfc28c
# Which Problems Are Solved Fixes multiple high-severity Dependabot alerts for transitive dependencies (axios, protobufjs, systeminformation, tmp, fast-uri, @babel/plugin-transform-modules-systemjs). # How the Problems Are Solved **Direct dependency updates:** - `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer dropped protobufjs as direct dep) - `posthog-js` 1.374 → 1.380 in console (dropped the OpenTelemetry/protobufjs chain entirely) **pnpm overrides** for remaining transitive deps that can't be updated via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or ajv): - `axios` → ≥1.17.0 (prototype pollution, proxy bypass) - `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution, DoS) - `systeminformation` → ≥5.31.6 (command injection) - `tmp` → ≥0.2.6 (path traversal) - `fast-uri` → ≥3.1.2 (path traversal, host confusion) **Benchmark:** refreshed `package-lock.json` to resolve @babel and fast-uri alerts.
32 lines
843 B
YAML
32 lines
843 B
YAML
packages:
|
|
- console
|
|
- tests/*
|
|
- packages/*
|
|
- apps/*
|
|
- deploy/compose
|
|
|
|
exclude:
|
|
- benchmark # because of the node 18 or 20 dependency
|
|
|
|
overrides:
|
|
"tar@<7.5.11": "^7.5.11 <8.0.0"
|
|
"flatted@<3.4.2": "^3.4.2"
|
|
"rollup@>=4.0.0 <4.59.0": "^4.59.0"
|
|
"socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6"
|
|
"picomatch@>=4.0.0 <4.0.4": "^4.0.4"
|
|
"lodash@>=4.0.0 <4.18.0": "^4.18.0"
|
|
"js-yaml@<3.14.2": "^3.14.2"
|
|
"qs@<6.14.2": "^6.14.2"
|
|
"ajv@<6.14.0": "^6.14.0"
|
|
"minimatch@<3.1.4": "^3.1.4"
|
|
"dompurify@>=3.1.3 <3.3.2": "^3.3.2"
|
|
"unhead@<2.1.11": "^2.1.11"
|
|
"brace-expansion@<1.1.13": "^1.1.13"
|
|
"yaml@>=2.0.0 <2.8.3": "^2.8.3"
|
|
"follow-redirects@<1.16.0": "^1.16.0"
|
|
"axios@<1.17.0": "^1.17.0"
|
|
"protobufjs@>=7.0.0 <7.5.7": "^7.5.7"
|
|
"systeminformation@<5.31.6": "^5.31.6"
|
|
"tmp@<0.2.6": "^0.2.6"
|
|
"fast-uri@<3.1.2": "^3.1.2"
|