From 9f836a003f55dd3264644454917a8326db91d545 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 04:42:17 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL/H?= =?UTF-8?q?IGH]=20Fix=20dependency=20vulnerabilities?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🚨 Severity: HIGH/MODERATE 💡 Vulnerability: Several dependencies (browserslist, qs, stream-json) had known vulnerabilities (memory growth leading to OOM, Uncaught crash, array-limit bypass, DoS). 🎯 Impact: Attackers could potentially cause denial of service (DoS) or craft inputs leading to memory exhaustion and server crashes. 🔧 Fix: Added version overrides in `pnpm-workspace.yaml` for `browserslist` (^4.28.8), `qs` (^6.16.0), and `stream-json` (^3.4.1) and updated the lockfile to resolve these nested vulnerable sub-dependencies. ✅ Verification: `pnpm audit` now returns "No known vulnerabilities found" and the test suite passes successfully. --- .jules/sentinel.md | 1 + package.json | 2 +- pnpm-lock.yaml | 80 ++++++++++++++++++++++----------------------- pnpm-workspace.yaml | 5 +-- 4 files changed, 44 insertions(+), 44 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..af142cb --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1 @@ +## 2024-05-30 - [Update Dependency for Security]\n**Vulnerability:** Moderate severity vulnerability in qs, stream-json etc\n**Learning:** Some dependencies carry potential DoS/prototype pollution vulnerabilities, which are critical enough to fix via updates.\n**Prevention:** Use npm audit/pnpm audit regularly and update tools like firebase-tools to the latest version to mitigate issues. diff --git a/package.json b/package.json index 95d8475..7376156 100644 --- a/package.json +++ b/package.json @@ -57,7 +57,7 @@ "@vitest/coverage-v8": "4.1.11", "eslint": "10.9.1", "eslint-config-next": "16.3.4", - "firebase-tools": "^15.28.2", + "firebase-tools": "^15.29.0", "globals": "^17.12.0", "jsdom": "30.0.1", "playwright": "1.62.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5f9443b..5676c8a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -19,9 +19,10 @@ overrides: dompurify: ^3.4.13 brace-expansion: ^5.0.9 mermaid: ^11.16.1 - qs: ^6.14.2 + qs: ^6.16.0 '@xmldom/xmldom': ^0.9.11 - browserslist: ^4.24.4 + browserslist: ^4.28.8 + stream-json: ^3.4.1 patchedDependencies: nextra-theme-docs: 82125a19d7899580770f4e436be0d74752fb6fa0d45fe977f2569bedae60ad51 @@ -134,8 +135,8 @@ importers: specifier: 16.3.4 version: 16.3.4(@typescript-eslint/parser@8.69.0(eslint@10.9.1(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(eslint@10.9.1(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3) firebase-tools: - specifier: ^15.28.2 - version: 15.28.2(@types/node@26.4.1)(supports-color@7.2.0) + specifier: ^15.29.0 + version: 15.29.0(@types/node@26.4.1)(supports-color@7.2.0) globals: specifier: ^17.12.0 version: 17.12.0 @@ -3626,8 +3627,8 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - browserslist@4.28.6: - resolution: {integrity: sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==} + browserslist@4.28.8: + resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -4318,8 +4319,8 @@ packages: ee-first@1.1.1: resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==} - electron-to-chromium@1.5.389: - resolution: {integrity: sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==} + electron-to-chromium@1.5.421: + resolution: {integrity: sha512-cUhfpHQy+PGbt+X90DMcAVazDCziIZr73hpxD4LRs4BGQoJCifPzTfQWa7S6c+uhokTOBe8tot09GBSEO6c9LA==} emoji-regex@8.0.0: resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==} @@ -4761,8 +4762,8 @@ packages: resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==} engines: {node: '>=10'} - firebase-tools@15.28.2: - resolution: {integrity: sha512-oC4qfRyY+voiNGR3JHmpfZ68SSNl4QjrLS625bvflxDnvWN1PumDSGWYkfZjs1XIosceSDHM7x5cGzBMxswi5w==} + firebase-tools@15.29.0: + resolution: {integrity: sha512-9v59oeU7seYNjMUykhQqodXl2J08QVVxVsxgJ0SycnX41xSA7nM4BboAdAK85z0tLSm6PsHjoNqop3cKAe4uaA==} engines: {node: '>=20.0.0 || >=22.0.0 || >=24.0.0'} hasBin: true @@ -6406,8 +6407,8 @@ packages: engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0} hasBin: true - node-releases@2.0.51: - resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==} + node-releases@2.0.54: + resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==} engines: {node: '>=18'} nopt@10.0.1: @@ -6841,10 +6842,6 @@ packages: resolution: {integrity: sha512-l1jNAspIBSFqbT+y+5FosojNpVpF94nlI+wDUpqP9enwOTfHx9f0gh5nB96vl+6yTpsJsypeNrwfzPrKuHB41A==} engines: {node: '>=8'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} - engines: {node: '>=0.6'} - qs@6.16.0: resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} @@ -7426,11 +7423,15 @@ packages: stream-chain@2.2.5: resolution: {integrity: sha512-1TJmBx6aSWqZ4tx7aTpBDXK0/e2hhcNSTV8+CbFJtDjbb+I1mZ8lHit0Grw9GRT+6JbIrrDd8esncgBi8aBXGA==} + stream-chain@4.2.5: + resolution: {integrity: sha512-Wtyq3bNE3ggLR0v2vftqvuhltym3WbZAkZpfIrkr5F/6vpeUmWmwTgXa16zD87gpahwJ/Qulq3zVfUlgIc0J2A==} + engines: {node: '>=22'} + stream-events@1.0.5: resolution: {integrity: sha512-E1GUzBSgvct8Jsb3v2X15pjzN1tYebtbLaMg+eBOUOAxgbLoSbT2NS91ckc5lJD1KfLjId+jXJRgo0qnV5Nerg==} - stream-json@1.9.1: - resolution: {integrity: sha512-uWkjJ+2Nt/LO9Z/JyKZbMusL8Dkh97uUBTv3AJQ74y07lVahLY4eEFsPsE97pxYBwr8nnjMAIch5eqI0gPShyw==} + stream-json@3.6.0: + resolution: {integrity: sha512-NiJdqxKyau579z/E8vfqcjWfSDWxW/AT99javFXdPXF147Z5za85LRXSHEmSX9TKOakB7gaIccfD0fOIctb7KQ==} stream-shift@1.0.3: resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==} @@ -7890,11 +7891,11 @@ packages: unrs-resolver@1.12.2: resolution: {integrity: sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} + update-browserslist-db@1.3.2: + resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==} hasBin: true peerDependencies: - browserslist: ^4.24.4 + browserslist: ^4.28.8 update-notifier-cjs@5.1.7: resolution: {integrity: sha512-eZWTh8F+VCEoC4UIh0pKmh8h4izj65VvLhCpJpVefUxdYe0fU3GBrC4Sbh1AoWA/miNPAb6UVlp2fUQNsfp+3g==} @@ -8442,7 +8443,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.6 + browserslist: 4.28.8 lru-cache: 5.1.1 semver: 6.3.1 @@ -11503,7 +11504,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.0 raw-body: 2.5.3 type-is: 1.6.18 unpipe: 1.0.0 @@ -11543,13 +11544,13 @@ snapshots: dependencies: fill-range: 7.1.1 - browserslist@4.28.6: + browserslist@4.28.8: dependencies: baseline-browser-mapping: 2.11.20 caniuse-lite: 1.0.30001810 - electron-to-chromium: 1.5.389 - node-releases: 2.0.51 - update-browserslist-db: 1.2.3(browserslist@4.28.6) + electron-to-chromium: 1.5.421 + node-releases: 2.0.54 + update-browserslist-db: 1.3.2(browserslist@4.28.8) buffer-crc32@0.2.13: {} @@ -12236,7 +12237,7 @@ snapshots: ee-first@1.1.1: {} - electron-to-chromium@1.5.389: {} + electron-to-chromium@1.5.421: {} emoji-regex@8.0.0: {} @@ -12826,7 +12827,7 @@ snapshots: parseurl: 1.3.3 path-to-regexp: 8.4.2 proxy-addr: 2.0.7 - qs: 6.15.3 + qs: 6.16.0 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.2(supports-color@7.2.0) @@ -12977,7 +12978,7 @@ snapshots: locate-path: 6.0.0 path-exists: 4.0.0 - firebase-tools@15.28.2(@types/node@26.4.1)(supports-color@7.2.0): + firebase-tools@15.29.0(@types/node@26.4.1)(supports-color@7.2.0): dependencies: '@apphosting/common': 0.0.8 '@electric-sql/pglite': 0.3.16 @@ -13035,7 +13036,7 @@ snapshots: semver: 7.8.5 sql-formatter: 15.8.2 stream-chain: 2.2.5 - stream-json: 1.9.1 + stream-json: 3.6.0 superstatic: 10.0.0(supports-color@7.2.0) tar: 7.5.22 tcp-port-used: 1.0.3(supports-color@7.2.0) @@ -15107,7 +15108,7 @@ snapshots: which: 7.0.0 optional: true - node-releases@2.0.51: {} + node-releases@2.0.54: {} nopt@10.0.1: dependencies: @@ -15604,11 +15605,6 @@ snapshots: dependencies: escape-goat: 2.1.1 - qs@6.15.3: - dependencies: - es-define-property: 1.0.1 - side-channel: 1.1.1 - qs@6.16.0: dependencies: es-define-property: 1.0.1 @@ -16482,13 +16478,15 @@ snapshots: stream-chain@2.2.5: {} + stream-chain@4.2.5: {} + stream-events@1.0.5: dependencies: stubs: 3.0.0 - stream-json@1.9.1: + stream-json@3.6.0: dependencies: - stream-chain: 2.2.5 + stream-chain: 4.2.5 stream-shift@1.0.3: {} @@ -17059,9 +17057,9 @@ snapshots: '@unrs/resolver-binding-win32-ia32-msvc': 1.12.2 '@unrs/resolver-binding-win32-x64-msvc': 1.12.2 - update-browserslist-db@1.2.3(browserslist@4.28.6): + update-browserslist-db@1.3.2(browserslist@4.28.8): dependencies: - browserslist: 4.28.6 + browserslist: 4.28.8 escalade: 3.2.0 picocolors: 1.1.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b7f8faa..be21926 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -53,6 +53,7 @@ overrides: dompurify: "^3.4.13" brace-expansion: "^5.0.9" mermaid: "^11.16.1" - qs: "^6.14.2" + qs: "^6.16.0" "@xmldom/xmldom": "^0.9.11" - browserslist: "^4.24.4" + browserslist: "^4.28.8" + stream-json: "^3.4.1"