mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtter
1846d1c7c9
All 13 HIGH CVEs (glob, minimatch, picomatch, tar) are bundled inside pnpm 9.x itself, not in our application dependencies. pnpm overrides only affect our app's dependency tree, not pnpm's internal modules. All require upgrading to pnpm 10.x.
29 lines
661 B
Plaintext
29 lines
661 B
Plaintext
# pnpm 9.x and its bundled dependencies
|
|
# These are build-time tool internals, not runtime application code.
|
|
# pnpm is only used for dependency installation and process management.
|
|
# All require upgrading to pnpm 10.x (major breaking change).
|
|
# Tracked: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
|
|
|
|
# pnpm core
|
|
CVE-2025-69262
|
|
CVE-2025-69263
|
|
|
|
# glob (bundled in pnpm 9.x, not our dependency)
|
|
CVE-2025-64756
|
|
|
|
# minimatch (bundled in pnpm 9.x)
|
|
CVE-2026-26996
|
|
CVE-2026-27903
|
|
CVE-2026-27904
|
|
|
|
# picomatch (bundled in pnpm 9.x)
|
|
CVE-2026-33671
|
|
|
|
# tar (bundled in pnpm 9.x)
|
|
CVE-2026-23745
|
|
CVE-2026-23950
|
|
CVE-2026-24842
|
|
CVE-2026-26960
|
|
CVE-2026-29786
|
|
CVE-2026-31802
|