From f2d93715e4b8591dcb98bb4f4e042b0cd498c73e Mon Sep 17 00:00:00 2001 From: Mark Murray Date: Tue, 1 Sep 2026 16:09:48 +0100 Subject: [PATCH 1/2] chore(protocol): patch vulnerable transitive dependencies --- protocol/package.json | 6 ++++++ protocol/pnpm-lock.yaml | 12 ++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/protocol/package.json b/protocol/package.json index d75069b6f..6f995329c 100644 --- a/protocol/package.json +++ b/protocol/package.json @@ -8,6 +8,12 @@ "engines": { "node": ">=22.14.0" }, + "pnpm": { + "overrides": { + "brace-expansion@1": "1.1.16", + "nanoid@3": "3.3.18" + } + }, "scripts": { "check-tools": "./scripts/check_codegen_tools.sh", "codegen:kotlin": "./scripts/generate_models.sh --lang kotlin", diff --git a/protocol/pnpm-lock.yaml b/protocol/pnpm-lock.yaml index e3a651dad..1ddcc91cd 100644 --- a/protocol/pnpm-lock.yaml +++ b/protocol/pnpm-lock.yaml @@ -4,6 +4,10 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + brace-expansion@1: 1.1.16 + nanoid@3: 3.3.18 + importers: .: @@ -440,8 +444,8 @@ packages: base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} brace-expansion@5.0.7: resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} @@ -1688,7 +1692,7 @@ snapshots: base64-js@1.5.1: {} - brace-expansion@1.1.14: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 @@ -2051,7 +2055,7 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.16 moment@2.30.1: {} From 9e35532f26b03f27a2b8335d6d3cd7ecdd709e21 Mon Sep 17 00:00:00 2001 From: Mark Murray Date: Tue, 1 Sep 2026 16:12:16 +0100 Subject: [PATCH 2/2] chore(web): patch vulnerable transitive dependencies --- platforms/web/package.json | 9 +++++++ platforms/web/pnpm-lock.yaml | 52 +++++++++++++++--------------------- 2 files changed, 30 insertions(+), 31 deletions(-) diff --git a/platforms/web/package.json b/platforms/web/package.json index 0164b8cf9..ec484f4bb 100644 --- a/platforms/web/package.json +++ b/platforms/web/package.json @@ -91,5 +91,14 @@ "engines": { "node": ">=22.14.0" }, + "pnpm": { + "overrides": { + "brace-expansion@2": "2.1.4", + "brace-expansion@5": "5.0.7", + "fast-uri@3": "3.1.5", + "nanoid@3": "3.3.18", + "postcss@8": "8.5.26" + } + }, "customElements": "dist/custom-elements.json" } diff --git a/platforms/web/pnpm-lock.yaml b/platforms/web/pnpm-lock.yaml index 6e662ca87..773cf6799 100644 --- a/platforms/web/pnpm-lock.yaml +++ b/platforms/web/pnpm-lock.yaml @@ -4,6 +4,13 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + brace-expansion@2: 2.1.4 + brace-expansion@5: 5.0.7 + fast-uri@3: 3.1.5 + nanoid@3: 3.3.18 + postcss@8: 8.5.26 + importers: .: @@ -1161,11 +1168,11 @@ packages: resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==} engines: {node: '>=8'} - brace-expansion@2.1.0: - resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -1266,8 +1273,8 @@ packages: resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==} engines: {node: '>=8.6.0'} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -1580,11 +1587,6 @@ packages: muggle-string@0.4.1: resolution: {integrity: sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} - engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} - hasBin: true - nanoid@3.3.18: resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} @@ -1650,10 +1652,6 @@ packages: pkg-types@2.3.1: resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} - engines: {node: ^10 || ^12 || >=14} - postcss@8.5.26: resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} engines: {node: ^10 || ^12 || >=14} @@ -2549,7 +2547,7 @@ snapshots: obug: 2.1.4 std-env: 4.2.0 tinyrainbow: 3.1.1 - vitest: 4.1.11(@types/node@22.19.18)(@vitest/coverage-v8@4.1.11)(happy-dom@20.8.9)(vite@8.2.2(@types/node@22.19.18)(esbuild@0.28.1)) + vitest: 4.1.11(@types/node@22.19.18)(@vitest/coverage-v8@4.1.11)(happy-dom@20.8.9)(vite@8.0.16(@types/node@22.19.18)(esbuild@0.28.1)) '@vitest/expect@4.1.11': dependencies: @@ -2689,7 +2687,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2724,11 +2722,11 @@ snapshots: binary-extensions@2.3.0: {} - brace-expansion@2.1.0: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.5: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -2841,7 +2839,7 @@ snapshots: merge2: 1.4.1 micromatch: 4.0.8 - fast-uri@3.1.2: {} + fast-uri@3.1.5: {} fastq@1.20.1: dependencies: @@ -3083,11 +3081,11 @@ snapshots: minimatch@10.2.3: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.4 mlly@1.8.2: dependencies: @@ -3102,8 +3100,6 @@ snapshots: muggle-string@0.4.1: {} - nanoid@3.3.12: {} - nanoid@3.3.18: {} normalize-path@3.0.0: {} @@ -3186,12 +3182,6 @@ snapshots: exsolve: 1.0.8 pathe: 2.0.3 - postcss@8.5.15: - dependencies: - nanoid: 3.3.12 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postcss@8.5.26: dependencies: nanoid: 3.3.18 @@ -3403,7 +3393,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.26 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: