From b9c5d7b8564b164af6183c982ce7778dad1dc358 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 10 Jun 2026 06:05:40 +0000 Subject: [PATCH] fix(root): resolve critical shell-quote and moderate fast-xml-parser, uuid vulnerabilities fixes DOC-344 - shell-quote (critical, GHSA-w7jw-789q-3m8p): pnpm override to ^1.8.4 (transitive via @scalar/api-client-react) - fast-xml-parser (moderate, GHSA-gh4j-gqv2-49f6): pnpm override to ^5.7.0 (transitive via fumadocs-openapi) - uuid (moderate): pnpm override to ^11.1.1 (transitive via @scalar/api-client-react) Co-authored-by: Dima Grossman --- package.json | 5 +++- pnpm-lock.yaml | 65 +++++++++++++++++++++++++++++++++++++------------- 2 files changed, 52 insertions(+), 18 deletions(-) diff --git a/package.json b/package.json index ae93a3362..273a825f5 100644 --- a/package.json +++ b/package.json @@ -120,6 +120,7 @@ "flatted@<3.4.2": "^3.4.2", "form-data@>=4.0.0 <4.0.4": "^4.0.4", "fast-xml-parser@<4.5.5": "^4.5.5", + "fast-xml-parser@<5.7.0": "^5.7.0", "glob@>=10.2.0 <10.5.0": "^10.5.0", "js-yaml@<3.14.2": "^3.14.2", "js-yaml@>=4.0.0 <4.1.1": "^4.1.1", @@ -128,10 +129,12 @@ "minimatch@>=9.0.0 <9.0.7": "^9.0.7", "picomatch@<2.3.2": "^2.3.2", "serialize-javascript@<7.0.5": "^7.0.5", + "shell-quote@>=1.1.0 <=1.8.3": "^1.8.4", "seroval@<1.4.1": "^1.4.1", "socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6", "svgo@>=3.0.0 <3.3.3": "^3.3.3", - "undici@<6.24.0": "^6.24.0" + "undici@<6.24.0": "^6.24.0", + "uuid@<11.1.1": "^11.1.1" } }, "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d2e962bdf..1be4b4758 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -16,6 +16,7 @@ overrides: flatted@<3.4.2: ^3.4.2 form-data@>=4.0.0 <4.0.4: ^4.0.4 fast-xml-parser@<4.5.5: ^4.5.5 + fast-xml-parser@<5.7.0: ^5.7.0 glob@>=10.2.0 <10.5.0: ^10.5.0 js-yaml@<3.14.2: ^3.14.2 js-yaml@>=4.0.0 <4.1.1: ^4.1.1 @@ -24,10 +25,12 @@ overrides: minimatch@>=9.0.0 <9.0.7: ^9.0.7 picomatch@<2.3.2: ^2.3.2 serialize-javascript@<7.0.5: ^7.0.5 + shell-quote@>=1.1.0 <=1.8.3: ^1.8.4 seroval@<1.4.1: ^1.4.1 socket.io-parser@>=4.0.0 <4.2.6: ^4.2.6 svgo@>=3.0.0 <3.3.3: ^3.3.3 undici@<6.24.0: ^6.24.0 + uuid@<11.1.1: ^11.1.1 importers: @@ -1597,6 +1600,9 @@ packages: next: ^13.0.0 || ^14.0.0 || ^15.0.0 react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0 + '@nodable/entities@2.1.1': + resolution: {integrity: sha512-Pig3HxDIoMgjdEH8OCf/dkcTmLFjJRjWuq8jSnklu284/TKOPibSRERmOykiwmyXTtv61mP+44f3GMx0tLAyjg==} + '@nodelib/fs.scandir@2.1.5': resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==} engines: {node: '>= 8'} @@ -4351,8 +4357,11 @@ packages: fast-uri@3.1.2: resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} - fast-xml-parser@4.5.6: - resolution: {integrity: sha512-Yd4vkROfJf8AuJrDIVMVmYfULKmIJszVsMv7Vo71aocsKgFxpdlpSHXSaInvyYfgw2PRuObQSW2GFpVMUjxu9A==} + fast-xml-builder@1.2.0: + resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} + + fast-xml-parser@5.8.0: + resolution: {integrity: sha512-6bIM7fsJxeo3uXv7OncQYsBAMPJ7V16Slahl/6M98C/i2q+vB1+4a0MtrvYwDFEUrwDSbAmeLDRXsOBwrL7yAg==} hasBin: true fastq@1.19.0: @@ -5852,6 +5861,10 @@ packages: resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==} engines: {node: '>=8'} + path-expression-matcher@1.5.0: + resolution: {integrity: sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==} + engines: {node: '>=14.0.0'} + path-is-absolute@1.0.1: resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==} engines: {node: '>=0.10.0'} @@ -6340,8 +6353,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.2: - resolution: {integrity: sha512-AzqKpGKjrj7EM6rKVQEPpB288oCfnrEIuyoT9cyF4nmGa7V8Zk6f7RRqYisX8X9m+Q7bd632aZW4ky7EhbQztA==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} shiki@2.5.0: @@ -6524,8 +6537,8 @@ packages: resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==} engines: {node: '>=8'} - strnum@1.1.2: - resolution: {integrity: sha512-vrN+B7DBIoTTZjnPNewwhx6cBA/H+IS7rfW68n7XxC1y7uoiGQBxaKzqucGUgavX15dJgiGztLJ8vxuEzwqBdA==} + strnum@2.3.0: + resolution: {integrity: sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==} style-mod@4.1.2: resolution: {integrity: sha512-wnD1HyVqpJUI2+eKZ+eo1UwghftP6yuFheBqqe+bWCotBjC2K1YnteJILRMs3SM4V/0dLEW1SC27MWP5y+mwmw==} @@ -6925,9 +6938,8 @@ packages: util-deprecate@1.0.2: resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==} - uuid@9.0.1: - resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} hasBin: true uvu@0.5.6: @@ -7085,6 +7097,10 @@ packages: resolution: {integrity: sha512-7rVi2KMfwfWFl+GpPg6m80IVMWXLRjO+PxTq7V2CDhoGak0wzYzFgUY2m4XJ47OGdXd8eLE8EmwfAmdjw7lC1g==} hasBin: true + xml-naming@0.1.0: + resolution: {integrity: sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==} + engines: {node: '>=16.0.0'} + xmlhttprequest-ssl@2.0.0: resolution: {integrity: sha512-QKxVRxiRACQcVuQEYFsI1hhkrMlrXHPegbbd1yn9UHOmRxY+si12nQYzri3vbzt8VdTTRviqcKxcyllFas5z2A==} engines: {node: '>=0.4.0'} @@ -8286,7 +8302,7 @@ snapshots: content-type: 1.0.5 json-stringify-deterministic: 1.0.12 just-curry-it: 5.3.0 - uuid: 9.0.1 + uuid: 11.1.1 '@hyperjump/pact@1.3.0': dependencies: @@ -8714,6 +8730,8 @@ snapshots: react: 19.0.0 third-party-capital: 1.0.20 + '@nodable/entities@2.1.1': {} + '@nodelib/fs.scandir@2.1.5': dependencies: '@nodelib/fs.stat': 2.0.5 @@ -9779,7 +9797,7 @@ snapshots: nanoid: 5.0.9 pretty-bytes: 6.1.1 pretty-ms: 8.0.0 - shell-quote: 1.8.2 + shell-quote: 1.8.4 vue: 3.5.13(typescript@5.8.2) vue-router: 4.5.0(vue@3.5.13(typescript@5.8.2)) whatwg-mimetype: 4.0.0 @@ -11988,9 +12006,18 @@ snapshots: fast-uri@3.1.2: {} - fast-xml-parser@4.5.6: + fast-xml-builder@1.2.0: + dependencies: + path-expression-matcher: 1.5.0 + xml-naming: 0.1.0 + + fast-xml-parser@5.8.0: dependencies: - strnum: 1.1.2 + '@nodable/entities': 2.1.1 + fast-xml-builder: 1.2.0 + path-expression-matcher: 1.5.0 + strnum: 2.3.0 + xml-naming: 0.1.0 fastq@1.19.0: dependencies: @@ -13818,7 +13845,7 @@ snapshots: openapi-sampler@1.6.1: dependencies: '@types/json-schema': 7.0.15 - fast-xml-parser: 4.5.6 + fast-xml-parser: 5.8.0 json-pointer: 0.6.2 optionator@0.9.4: @@ -13939,6 +13966,8 @@ snapshots: path-exists@4.0.0: {} + path-expression-matcher@1.5.0: {} + path-is-absolute@1.0.1: {} path-key@3.1.1: {} @@ -14596,7 +14625,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.2: {} + shell-quote@1.8.4: {} shiki@2.5.0: dependencies: @@ -14854,7 +14883,7 @@ snapshots: strip-json-comments@3.1.1: {} - strnum@1.1.2: {} + strnum@2.3.0: {} style-mod@4.1.2: {} @@ -15248,7 +15277,7 @@ snapshots: util-deprecate@1.0.2: {} - uuid@9.0.1: {} + uuid@11.1.1: {} uvu@0.5.6: dependencies: @@ -15455,6 +15484,8 @@ snapshots: dependencies: sax: 1.4.1 + xml-naming@0.1.0: {} + xmlhttprequest-ssl@2.0.0: {} yallist@3.1.1: {}