diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5d1518a..a61e8b0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,14 +7,17 @@ settings: overrides: esbuild@<0.28.1: '>=0.28.1' postcss@<8.5.10: '>=8.5.10' - undici@<6.28.0: ^6.28.0 + undici@<6.28.1: ^6.28.1 uuid@<11.1.1: '>=11.1.1' find-my-way@<9.7.0: '>=9.7.0 <10' - fast-uri@<3.1.5: '>=3.1.5 <4' + fast-uri@<3.1.8: '>=3.1.8 <4' sharp@<0.35.0: '>=0.35.0' minimatch@<10: '>=10 <11' brace-expansion@<5.0.9: '>=5.0.9' mysql2@<3.22.0: '>=3.22.0 <4' + deepmerge-ts@<8.0.0: '>=8.0.0 <9' + source-map-js@<1.2.2: '>=1.2.2 <2' + postcss-selector-parser@<7.1.6: '>=7.1.6 <8' importers: @@ -1776,9 +1779,9 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge-ts@7.1.5: - resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==} - engines: {node: '>=16.0.0'} + deepmerge-ts@8.0.2: + resolution: {integrity: sha512-uqbvqLUMrc6p0MO+WBRtTxY55hmyh94WRwI5a++PZe54X+bfVh59FSN7uWCBCW1CCVjzjnrwzfI8zidE2obMMw==} + engines: {node: '>=16.9.0'} defu@6.1.7: resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==} @@ -1951,8 +1954,8 @@ packages: fast-querystring@1.1.2: resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==} - fast-uri@3.1.6: - resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -2509,8 +2512,8 @@ packages: peerDependencies: postcss: '>=8.5.10' - postcss-selector-parser@6.1.4: - resolution: {integrity: sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==} + postcss-selector-parser@7.1.6: + resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==} engines: {node: '>=4'} postcss-value-parser@4.2.0: @@ -2797,10 +2800,6 @@ packages: resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==} engines: {node: '>=14'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} - engines: {node: '>=0.10.0'} - source-map-js@1.2.2: resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} @@ -2964,8 +2963,8 @@ packages: undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@6.28.0: - resolution: {integrity: sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==} + undici@6.29.0: + resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} engines: {node: '>=18.17'} unzipper@0.10.14: @@ -3383,7 +3382,7 @@ snapshots: discord-api-types: 0.38.50 magic-bytes.js: 1.13.0 tslib: 2.8.1 - undici: 6.28.0 + undici: 6.29.0 '@discordjs/util@1.2.0': dependencies: @@ -3765,7 +3764,7 @@ snapshots: '@prisma/config@7.10.0': dependencies: c12: 3.3.4 - deepmerge-ts: 7.1.5 + deepmerge-ts: 8.0.2 effect: 3.20.0 empathic: 2.0.0 transitivePeerDependencies: @@ -4369,7 +4368,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4662,7 +4661,7 @@ snapshots: deep-is@0.1.4: {} - deepmerge-ts@7.1.5: {} + deepmerge-ts@8.0.2: {} defu@6.1.7: {} @@ -4696,7 +4695,7 @@ snapshots: lodash.snakecase: 4.1.1 magic-bytes.js: 1.13.0 tslib: 2.8.1 - undici: 6.28.0 + undici: 6.29.0 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -4882,7 +4881,7 @@ snapshots: dependencies: fast-decode-uri-component: 1.0.1 - fast-uri@3.1.6: {} + fast-uri@3.1.8: {} fastq@1.20.1: dependencies: @@ -5367,9 +5366,9 @@ snapshots: postcss-nested@6.2.0(postcss@8.5.28): dependencies: postcss: 8.5.28 - postcss-selector-parser: 6.1.4 + postcss-selector-parser: 7.1.6 - postcss-selector-parser@6.1.4: + postcss-selector-parser@7.1.6: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -5386,7 +5385,7 @@ snapshots: dependencies: nanoid: 3.3.19 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 postgres-array@2.0.0: {} @@ -5630,8 +5629,6 @@ snapshots: signal-exit@4.1.0: {} - source-map-js@1.2.1: {} - source-map-js@1.2.2: {} split2@4.2.0: {} @@ -5710,7 +5707,7 @@ snapshots: postcss-js: 4.1.0(postcss@8.5.28) postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.28)(tsx@4.23.15) postcss-nested: 6.2.0(postcss@8.5.28) - postcss-selector-parser: 6.1.4 + postcss-selector-parser: 7.1.6 resolve: 1.22.12 sucrase: 3.35.1 transitivePeerDependencies: @@ -5798,7 +5795,7 @@ snapshots: undici-types@8.9.0: {} - undici@6.28.0: {} + undici@6.29.0: {} unzipper@0.10.14: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 145ada2..c3cf34e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -19,7 +19,9 @@ overrides: # GHSA-8xcm-r25x-g524 / GHSA-m8rv-5g2x-5cg5 / GHSA-v3r7-h72x-cjcm — three undici # advisories all first patched in 6.28.0. Transitive via discord.js, which pins # the version exactly, so the bot only gets the fix through this override. - "undici@<6.28.0": "^6.28.0" + # GHSA-rfgv-xxqx-mfg5 / GHSA-3wwx-pv8p-q78v / GHSA-r53p-7pc4-xj5r (WebSocket + # subprotocol crash, inflater limit, retry response splitting) need 6.28.1. + "undici@<6.28.1": "^6.28.1" # GHSA-w5hq-g745-h8pq — uuid missing buffer bounds check in v3/v5/v6 (transitive # via exceljs, which only uses v4). Force the patched line; v4 API is unchanged. "uuid@<11.1.1": ">=11.1.1" @@ -30,7 +32,10 @@ overrides: # GHSA-4c8g-83qw-93j6 — fast-uri host confusion via failed IDN canonicalization, # then GHSA-7p8r-x3mc-p8w7 on top, which flags everything below 3.1.5 # (transitive via ajv, dev-only). Stay on the 3.x line ajv asks for. - "fast-uri@<3.1.5": ">=3.1.5 <4" + # GHSA-qw65-cvwx-89v3 / GHSA-58mr-gqgx-xq4g / GHSA-hrr3-gc8f-f4qj are the next + # rounds (now via prisma's @prisma/dev > @prisma/streams-local > ajv), the last + # one fixed in 3.1.8. + "fast-uri@<3.1.8": ">=3.1.8 <4" # GHSA-f88m-g3jw-g9cj — libvips CVEs inherited by sharp. We depend on 0.35.x # directly; this only lifts the older copy next pulls in as an optional dep. "sharp@<0.35.0": ">=0.35.0" @@ -56,3 +61,16 @@ overrides: # exactly at 3.15.3 for its MySQL datasource support, and this project talks to # Postgres), but the exact pin means the fix only lands through an override. "mysql2@<3.22.0": ">=3.22.0 <4" + # GHSA-ggr8-5vv4-36mx — deepmerge-ts stack exhaustion on recursive object graphs. + # @prisma/config pins 7.1.5 exactly and Prisma only moves to 8.x in 8.1. + # @prisma/config only calls deepmerge(), which the v8 breaking changes + # (deepmergeInto aliasing, renamed meta-data types) leave untouched. + "deepmerge-ts@<8.0.0": ">=8.0.0 <9" + # GHSA-68fv-2mgg-jv7q — source-map-js event-loop DoS via indexed source-map + # section offsets. Dev-only (postcss under vite/vitest), patched in 1.2.2. + "source-map-js@<1.2.2": ">=1.2.2 <2" + # GHSA-rj75-hqrm-r3gf — postcss-selector-parser, only patched on the 7.x line + # (7.1.6). Comes in via tailwindcss 3 and postcss-nested, which ask for ^6. + # The only breaking change in 7.0.0 makes insertions during iteration safe; + # the generated CSS is byte-identical with the bump. + "postcss-selector-parser@<7.1.6": ">=7.1.6 <8"