chore: #105 dependency and security upgrades (pnpm 11, Node 24) - #108
Open
th-huber wants to merge 12 commits into
Open
chore: #105 dependency and security upgrades (pnpm 11, Node 24)#108th-huber wants to merge 12 commits into
th-huber wants to merge 12 commits into
Conversation
(cherry picked from commit 941ce2a)
(cherry picked from commit ea867e9)
Fixes known CVEs/advisories in 7.0.13 (SMTP injection, CRLF header injection, and related hardening). Types updated to @types/nodemailer@8.0.1. (cherry picked from commit 8476ce9)
Fixes GHSA-6g55-p6wh-862q (arbitrary file read via sourceMappingURL) and GHSA-qx2v-qp2m-jg93 (XSS via unescaped </style>) from next's pinned 8.4.31. Resolved to postcss@8.5.22 via pnpm-workspace.yaml overrides. (cherry picked from commit 27ec1ce)
Fixes GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6) from exceljs's pinned uuid@8.3.2. Resolved to uuid@14.0.1 via scoped pnpm-workspace.yaml override (exceljs>uuid). (cherry picked from commit 06c2f90)
Fixes CVE-2026-39244 (unbounded Buffer.alloc / OOM from crafted ZIP). Dropped @types/adm-zip; 0.6 ships built-in TypeScript types. (cherry picked from commit 3723ca0)
find-my-way is only a transitive dep of @prisma/dev (local Prisma tooling), not our HTTP router. The advisory is a DoS only when find-my-way is used with Node's HTTP/2 server, which we don't expose. (cherry picked from commit 834f59a)
sharp is only a transitive dep of Next's image optimizer. We don't process untrusted images through sharp (project logos use plain img; next/image is mostly static assets), so the libvips CVEs are low risk for this app. (cherry picked from commit 9dc4f03)
(cherry picked from commit e5ce36e)
authorize() was spreading the full Prisma user into the credentials result, so password hashes, invite/reset tokens, and relation data ended up in token.user and the client-readable /api/auth/session response. An attacker with XSS, malicious client script, or local access to a logged-in browser could read the hash (for offline cracking / password reuse) or a live reset/invite token (account takeover). Return only explicit safe fields (id, name, email, image, roles, managerOf, loanedToProjects, language), and allow session.update to patch only name and language. (cherry picked from commit d3d2e31)
Security upates needed pnpm overrides. Overrides live in pnpm-workspace.yaml; without it, frozen lockfile install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. (cherry picked from commit 6efc85a)
(cherry picked from commit aedde81)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm-workspace.yamlfor frozen installsCloses #105