From f21667db67d461f69f510e162979ceb7f97f5826 Mon Sep 17 00:00:00 2001 From: SnapOtter Date: Sun, 21 Jun 2026 11:59:26 +0800 Subject: [PATCH] chore(deps): patch vulnerable dependencies (Dependabot/CodeQL) - dompurify >=3.4.11 (runtime SVG sanitization) - nanoid 4.x -> >=5.0.9 (vulnerable 4.0.x transitive; 3.x/5.x kept) - undici >=8.5.0 (dev-only: jsdom/vitest/semantic-release; removes 8.4.1) - rembg 2.0.69 -> 2.0.75 (Python AI sidecar, CPU + GPU) js-yaml is already >=4.2.0; the residual 3.14.2 is gray-matter's build-time pin (no 3.x patch exists). typecheck + build pass. --- package.json | 5 ++- packages/ai/python/requirements-gpu.txt | 2 +- packages/ai/python/requirements.txt | 2 +- pnpm-lock.yaml | 56 +++++++++++-------------- 4 files changed, 30 insertions(+), 35 deletions(-) diff --git a/package.json b/package.json index b20236d8..e99a4b2f 100644 --- a/package.json +++ b/package.json @@ -113,7 +113,10 @@ "gray-matter>js-yaml": "^3.14.1", "qs": ">=6.15.2", "uuid": ">=11.1.1", - "yaml": ">=2.8.3" + "yaml": ">=2.8.3", + "dompurify": ">=3.4.11", + "nanoid@4": ">=5.0.9", + "undici": ">=8.5.0" } }, "dependencies": { diff --git a/packages/ai/python/requirements-gpu.txt b/packages/ai/python/requirements-gpu.txt index 18d5c37f..b5c0c1c8 100644 --- a/packages/ai/python/requirements-gpu.txt +++ b/packages/ai/python/requirements-gpu.txt @@ -1,4 +1,4 @@ -rembg==2.0.69 +rembg==2.0.75 realesrgan==0.3.0 paddleocr==2.9.1 paddlepaddle-gpu==3.0.0 diff --git a/packages/ai/python/requirements.txt b/packages/ai/python/requirements.txt index 74a546c6..73131a9e 100644 --- a/packages/ai/python/requirements.txt +++ b/packages/ai/python/requirements.txt @@ -1,4 +1,4 @@ -rembg[cpu]==2.0.69 +rembg[cpu]==2.0.75 realesrgan==0.3.0 paddleocr[doc-parser]>=3.4.0,<3.5.0 paddlepaddle>=3.0.0,<3.1.0 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 27841904..637c7ca4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -28,6 +28,9 @@ overrides: qs: '>=6.15.2' uuid: '>=11.1.1' yaml: '>=2.8.3' + dompurify: '>=3.4.11' + nanoid@4: '>=5.0.9' + undici: '>=8.5.0' importers: @@ -4690,8 +4693,8 @@ packages: resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==} engines: {node: '>= 4'} - dompurify@3.4.10: - resolution: {integrity: sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==} + dompurify@3.4.11: + resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==} domutils@3.2.2: resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==} @@ -6218,11 +6221,6 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - nanoid@4.0.2: - resolution: {integrity: sha512-7ZtY5KTCNheRGfEFxnedV5zFiORN1+Y1N6zvPTnHQd8ENUvfaDBeuJDZb2bN/oXwXxu3qkTXDzy57W5vAmDTBw==} - engines: {node: ^14 || ^16 || >=18} - hasBin: true - nanoid@5.1.11: resolution: {integrity: sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg==} engines: {node: ^18 || >=20} @@ -7207,6 +7205,11 @@ packages: engines: {node: '>=10'} hasBin: true + semver@7.8.5: + resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==} + engines: {node: '>=10'} + hasBin: true + set-blocking@2.0.0: resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==} @@ -7772,16 +7775,8 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@6.25.0: - resolution: {integrity: sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==} - engines: {node: '>=18.17'} - - undici@7.25.0: - resolution: {integrity: sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ==} - engines: {node: '>=20.18.1'} - - undici@8.4.1: - resolution: {integrity: sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==} + undici@8.5.0: + resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==} engines: {node: '>=22.19.0'} unicode-emoji-modifier-base@1.0.0: @@ -8453,7 +8448,7 @@ snapshots: '@actions/http-client@4.0.0': dependencies: tunnel: 0.0.6 - undici: 6.25.0 + undici: 8.5.0 '@actions/io@3.0.2': {} @@ -11260,7 +11255,7 @@ snapshots: p-filter: 4.1.0 semantic-release: 25.0.5(typescript@5.9.3) tinyglobby: 0.2.16 - undici: 7.25.0 + undici: 8.5.0 url-join: 5.0.0 transitivePeerDependencies: - supports-color @@ -13127,7 +13122,7 @@ snapshots: dependencies: domelementtype: 2.3.0 - dompurify@3.4.10: + dompurify@3.4.11: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -13575,7 +13570,7 @@ snapshots: '@petamoriken/float16': 3.9.3 debug: 4.4.3 env-paths: 3.0.0 - semver: 7.8.4 + semver: 7.8.5 shell-quote: 1.8.4 which: 4.0.0 transitivePeerDependencies: @@ -14084,7 +14079,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.25.0 + undici: 8.5.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -14845,8 +14840,6 @@ snapshots: nanoid@3.3.12: {} - nanoid@4.0.2: {} - nanoid@5.1.11: {} napi-build-utils@2.0.0: {} @@ -15279,7 +15272,7 @@ snapshots: '@posthog/core': 1.32.3 '@posthog/types': 1.386.3 core-js: 3.49.0 - dompurify: 3.4.10 + dompurify: 3.4.11 fflate: 0.4.8 preact: 10.29.2 query-selector-shadow-dom: 1.0.1 @@ -15831,6 +15824,9 @@ snapshots: semver@7.8.4: {} + semver@7.8.5: + optional: true + set-blocking@2.0.0: {} set-cookie-parser@2.7.2: {} @@ -16315,7 +16311,7 @@ snapshots: ssh-remote-port-forward: 1.0.4 tar-fs: 3.1.2 tmp: 0.2.7 - undici: 8.4.1 + undici: 8.5.0 transitivePeerDependencies: - bare-abort-controller - bare-buffer @@ -16499,11 +16495,7 @@ snapshots: undici-types@7.24.6: optional: true - undici@6.25.0: {} - - undici@7.25.0: {} - - undici@8.4.1: {} + undici@8.5.0: {} unicode-emoji-modifier-base@1.0.0: {} @@ -16941,7 +16933,7 @@ snapshots: dependencies: fuse.js: 6.6.2 mitt: 3.0.1 - nanoid: 4.0.2 + nanoid: 5.1.11 vue@3.5.30(typescript@5.9.3): dependencies: