From 37b033d172e5d0dd76af0d2c1eaa955c5371688d Mon Sep 17 00:00:00 2001 From: Robert DeLuca Date: Sat, 29 Aug 2026 18:32:27 -0500 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Patch=20audited=20transitive=20d?= =?UTF-8?q?ependencies?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolve the vulnerable js-yaml, socket.io-parser, and tmp versions through the workspace override configuration so pnpm installs the fixed packages consistently across runtime and Ember tooling. --- pnpm-lock.yaml | 79 ++++++++++++++------------------------------- pnpm-workspace.yaml | 8 +++-- 2 files changed, 29 insertions(+), 58 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a3708370..fb4c84ab 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,9 +5,11 @@ settings: excludeLinksFromLockfile: false overrides: - '@babel/runtime': ^7.29.7 - uuid: ^11.1.1 - ws: ^8.20.1 + '@babel/runtime@<7.26.10': 7.29.7 + js-yaml@>=4.0.0 <4.3.1: 4.3.1 + socket.io-parser@>=4.0.0 <4.2.7: 4.2.7 + tmp@<0.2.6: 0.2.7 + ws@<8.21.0: 8.21.3 importers: @@ -146,8 +148,8 @@ importers: specifier: ^8.0.1 version: 8.0.1(@babel/core@8.0.1) '@babel/runtime': - specifier: ^7.29.7 - version: 7.29.7 + specifier: ^8.0.0 + version: 8.0.0 '@ember/optional-features': specifier: ^3.0.0 version: 3.0.0(@types/node@26.2.0) @@ -1478,6 +1480,9 @@ packages: resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==} engines: {node: '>=6.9.0'} + '@babel/runtime@8.0.0': + resolution: {integrity: sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==} + '@babel/template@7.29.7': resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==} engines: {node: '>=6.9.0'} @@ -5578,12 +5583,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} - hasBin: true - - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsdom@25.0.1: @@ -6257,10 +6258,6 @@ packages: resolution: {integrity: sha512-qIb8bzRqaN/vVqEYZ7lTAg6PonskO7xOmM7OClD28F6eFa4s5XGe4bGpHUHMoCHbNNuR0pDYFeSLiW5bnjWXIA==} engines: {node: '>=12.20'} - os-tmpdir@1.0.2: - resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==} - engines: {node: '>=0.10.0'} - own-keys@1.0.1: resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==} engines: {node: '>= 0.4'} @@ -7034,8 +7031,8 @@ packages: socket.io-adapter@2.5.7: resolution: {integrity: sha512-e0LyK91f3cUxTmv95/KzoLg47+zF+s/sbxRGDNsyG4dmIP8ZSX8ax6byOxfJXeNNtS/8AZlfD+uP7gBeR7DLlg==} - socket.io-parser@4.2.6: - resolution: {integrity: sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==} + socket.io-parser@4.2.7: + resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==} engines: {node: '>=10.0.0'} socket.io@4.8.3: @@ -7436,18 +7433,6 @@ packages: resolution: {integrity: sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==} hasBin: true - tmp@0.0.28: - resolution: {integrity: sha512-c2mmfiBmND6SOVxzogm1oda0OJ1HZVIk/5n26N59dDTh80MUeavpiCls4PGAdkX1PFkKokLpcf7prSjCeXLsJg==} - engines: {node: '>=0.4.0'} - - tmp@0.0.33: - resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==} - engines: {node: '>=0.6.0'} - - tmp@0.1.0: - resolution: {integrity: sha512-J7Z2K08jbGcdA1kkQpJSqLF6T0tdQqpR2pnSUXsIchbPdTI9v3e85cLW0d6WDhwuAleOV71j2xWs8qMPfK7nKw==} - engines: {node: '>=6'} - tmp@0.2.7: resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==} engines: {node: '>=14.14'} @@ -9919,6 +9904,8 @@ snapshots: '@babel/runtime@7.29.7': {} + '@babel/runtime@8.0.0': {} + '@babel/template@7.29.7': dependencies: '@babel/code-frame': 7.29.7 @@ -12539,7 +12526,7 @@ snapshots: can-symlink@1.0.0: dependencies: - tmp: 0.0.28 + tmp: 0.2.7 caniuse-lite@1.0.30001806: {} @@ -12780,7 +12767,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.1 parse-json: 5.2.0 optionalDependencies: typescript: 7.0.2 @@ -13701,7 +13688,7 @@ snapshots: dependencies: chardet: 0.7.0 iconv-lite: 0.4.24 - tmp: 0.0.33 + tmp: 0.2.7 extract-stack@2.0.0: {} @@ -14631,11 +14618,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.1.1: - dependencies: - argparse: 2.0.1 - - js-yaml@4.2.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -15267,8 +15250,6 @@ snapshots: dependencies: lcid: 3.1.1 - os-tmpdir@1.0.2: {} - own-keys@1.0.1: dependencies: get-intrinsic: 1.3.0 @@ -16148,7 +16129,7 @@ snapshots: - supports-color - utf-8-validate - socket.io-parser@4.2.6: + socket.io-parser@4.2.7: dependencies: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 @@ -16163,7 +16144,7 @@ snapshots: debug: 4.4.3 engine.io: 6.6.8 socket.io-adapter: 2.5.7 - socket.io-parser: 4.2.6 + socket.io-parser: 4.2.7 transitivePeerDependencies: - bufferutil - supports-color @@ -16568,7 +16549,7 @@ snapshots: express: 5.2.1 glob: 13.0.6 http-proxy: 1.18.1 - js-yaml: 4.1.1 + js-yaml: 4.3.1 lodash: 4.18.1 minimatch: 10.2.5 mkdirp: 3.0.1 @@ -16686,18 +16667,6 @@ snapshots: dependencies: tldts-core: 6.1.86 - tmp@0.0.28: - dependencies: - os-tmpdir: 1.0.2 - - tmp@0.0.33: - dependencies: - os-tmpdir: 1.0.2 - - tmp@0.1.0: - dependencies: - rimraf: 2.7.1 - tmp@0.2.7: {} tmpl@1.0.5: {} @@ -17057,7 +17026,7 @@ snapshots: dependencies: heimdalljs-logger: 0.1.10 silent-error: 1.1.1 - tmp: 0.1.0 + tmp: 0.2.7 transitivePeerDependencies: - supports-color diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 0deb9fab..53d13e6b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -6,9 +6,11 @@ packages: - test-site overrides: - '@babel/runtime': ^7.29.7 - uuid: ^11.1.1 - ws: ^8.20.1 + '@babel/runtime@<7.26.10': 7.29.7 + js-yaml@>=4.0.0 <4.3.1: 4.3.1 + socket.io-parser@>=4.0.0 <4.2.7: 4.2.7 + tmp@<0.2.6: 0.2.7 + ws@<8.21.0: 8.21.3 minimumReleaseAge: 10080 minimumReleaseAgeStrict: true