From 9bb14b1396ee7fd0dd232f39c565c3dae036e8c4 Mon Sep 17 00:00:00 2001 From: april418 Date: Tue, 21 Jul 2026 16:53:17 +0900 Subject: [PATCH] =?UTF-8?q?chore(deps):=202026-07=20audit=20=E6=B3=A2?= =?UTF-8?q?=E3=81=AE=E8=84=86=E5=BC=B1=E6=80=A7=20override=20=E3=82=92?= =?UTF-8?q?=E8=BF=BD=E5=8A=A0=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit brace-expansion / js-yaml / websocket-driver / shell-quote / axios に 対する新規 advisory 群 (GHSA-3jxr-9vmj-r5cp ほか critical 1 件・ high 4 件) の公開により pnpm audit が失敗していた。本リポジトリで 検出された advisory に対応する override を pnpm-workspace.yaml に 追加し、lockfile を再生成して audit 0 件を確認した。 brace-expansion の 3.x-5.0.6 は patch が出ておらず 5.0.7 が必要。 5.0.x は lockfile の既存解決が range を満たし自然には上がらないため override で強制している。 Co-Authored-By: Claude Fable 5 --- pnpm-lock.yaml | 37 ++++++++++++++++++++----------------- pnpm-workspace.yaml | 4 ++++ 2 files changed, 24 insertions(+), 17 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 042cfea..c0660b0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,6 +9,9 @@ overrides: esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' + brace-expansion@1: '>=1.1.16 <2' + js-yaml@4: '>=4.3.0' + brace-expansion@>=3 <5.0.7: '>=5.0.7' importers: @@ -500,11 +503,11 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} call-bind-apply-helpers@1.0.2: @@ -1071,8 +1074,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} + js-yaml@5.2.1: + resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==} hasBin: true jsdom@25.0.1: @@ -1983,7 +1986,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 5.2.1 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -2125,7 +2128,7 @@ snapshots: '@types/normalize-package-data@2.4.4': {} - '@typescript-eslint/eslint-plugin@8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2)': + '@typescript-eslint/eslint-plugin@8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2)': dependencies: '@eslint-community/regexpp': 4.12.2 '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) @@ -2319,12 +2322,12 @@ snapshots: balanced-match@4.0.4: {} - brace-expansion@1.1.14: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.5: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -2507,7 +2510,7 @@ snapshots: transitivePeerDependencies: - typescript - eslint-plugin-prettier@5.5.5(eslint-config-prettier@10.1.8(eslint@10.1.0))(eslint@9.39.4)(prettier@3.8.1): + eslint-plugin-prettier@5.5.5(eslint-config-prettier@10.1.8(eslint@9.39.4))(eslint@9.39.4)(prettier@3.8.1): dependencies: eslint: 9.39.4 prettier: 3.8.1 @@ -2749,13 +2752,13 @@ snapshots: gts@7.0.0(typescript@6.0.2): dependencies: '@eslint/js': 9.39.4 - '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) + '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) chalk: 4.1.2 eslint: 9.39.4 eslint-config-prettier: 10.1.8(eslint@9.39.4) eslint-plugin-n: 17.24.0(eslint@9.39.4)(typescript@6.0.2) - eslint-plugin-prettier: 5.5.5(eslint-config-prettier@10.1.8(eslint@10.1.0))(eslint@9.39.4)(prettier@3.8.1) + eslint-plugin-prettier: 5.5.5(eslint-config-prettier@10.1.8(eslint@9.39.4))(eslint@9.39.4)(prettier@3.8.1) execa: 5.1.1 inquirer: 7.3.3 json5: 2.2.3 @@ -2924,7 +2927,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.1.1: + js-yaml@5.2.1: dependencies: argparse: 2.0.1 @@ -3145,11 +3148,11 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.7 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.16 minimist-options@4.1.0: dependencies: @@ -3497,7 +3500,7 @@ snapshots: typescript-eslint@8.57.2(eslint@9.39.4)(typescript@6.0.2): dependencies: - '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) + '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/typescript-estree': 8.57.2(typescript@6.0.2) '@typescript-eslint/utils': 8.57.2(eslint@9.39.4)(typescript@6.0.2) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index facf121..982203e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,6 +12,10 @@ overrides: esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' + # 2026-07 audit 波の新規 advisory 対応 + 'brace-expansion@1': '>=1.1.16 <2' + 'js-yaml@4': '>=4.3.0' + 'brace-expansion@>=3 <5.0.7': '>=5.0.7' packageManagerStrictVersion: true savePrefix: "" trustPolicy: no-downgrade