From dcb0d11e71a5b576d4af2bb1cae87fb4d5465728 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 24 Jun 2026 06:07:43 +0000 Subject: [PATCH] fix(root): resolve high undici and moderate ts-deepmerge vulnerabilities fixes DOC-364 - undici: update pnpm override from ^6.24.0 to ^6.27.0 (Strategy B) Advisory: https://github.com/advisories/GHSA-vxpw-j846-p89q Fixes WebSocket client DoS via fragment count bypass; also resolves related undici cookie/header injection and keep-alive advisories. - ts-deepmerge: add pnpm override to ^8.0.0 (Strategy B) Advisory: https://github.com/advisories/GHSA-87mf-gv2c-c62c Fixes prototype method override DoS in transitive @scalar dependency. Co-authored-by: Dima Grossman --- package.json | 3 ++- pnpm-lock.yaml | 19 ++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index aec14d859..6980183c0 100644 --- a/package.json +++ b/package.json @@ -137,8 +137,9 @@ "shell-quote@>=1.1.0 <=1.8.3": "^1.8.4", "seroval@<1.4.1": "^1.4.1", "socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6", + "ts-deepmerge@<8.0.0": "^8.0.0", "svgo@>=3.0.0 <3.3.3": "^3.3.3", - "undici@<6.24.0": "^6.24.0", + "undici@<6.27.0": "^6.27.0", "uuid@<11.1.1": "^11.1.1" } }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 744290f10..81b7acff0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -33,8 +33,9 @@ overrides: shell-quote@>=1.1.0 <=1.8.3: ^1.8.4 seroval@<1.4.1: ^1.4.1 socket.io-parser@>=4.0.0 <4.2.6: ^4.2.6 + ts-deepmerge@<8.0.0: ^8.0.0 svgo@>=3.0.0 <3.3.3: ^3.3.3 - undici@<6.24.0: ^6.24.0 + undici@<6.27.0: ^6.27.0 uuid@<11.1.1: ^11.1.1 importers: @@ -6735,8 +6736,8 @@ packages: peerDependencies: typescript: '>=4.8.4' - ts-deepmerge@7.0.2: - resolution: {integrity: sha512-akcpDTPuez4xzULo5NwuoKwYRtjQJ9eoNfBACiBMaXwNAx7B1PKfe5wqUFJuW5uKzQ68YjDFwPaWHDG1KnFGsA==} + ts-deepmerge@8.0.0: + resolution: {integrity: sha512-133O+10nJmVI8w5xeVZPEv5PIrv7iaUae07wv1aH8XJH95Ur6YIhWAPhPyP1YPlbPS9fCVcNIZTu7m8urRVF0A==} engines: {node: '>=14.13.1'} ts-morph@25.0.1: @@ -6811,8 +6812,8 @@ packages: undici-types@6.20.0: resolution: {integrity: sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==} - undici@6.25.0: - resolution: {integrity: sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==} + undici@6.27.0: + resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==} engines: {node: '>=18.17'} unfetch@3.1.2: @@ -9951,7 +9952,7 @@ snapshots: dependencies: flatted: 3.4.2 just-clone: 6.2.0 - ts-deepmerge: 7.0.2 + ts-deepmerge: 8.0.0 '@scalar/openapi-parser@0.10.12': dependencies: @@ -11375,7 +11376,7 @@ snapshots: hast-util-select: 6.0.3 html-url-attributes: 3.0.1 levenshtein-edit-distance: 3.0.1 - undici: 6.25.0 + undici: 6.27.0 unist-util-visit: 5.0.0 vfile-message: 4.0.2 @@ -15055,7 +15056,7 @@ snapshots: dependencies: typescript: 5.8.2 - ts-deepmerge@7.0.2: {} + ts-deepmerge@8.0.0: {} ts-morph@25.0.1: dependencies: @@ -15149,7 +15150,7 @@ snapshots: undici-types@6.20.0: {} - undici@6.25.0: {} + undici@6.27.0: {} unfetch@3.1.2: {}