From 90880da1cb5570de5fb96b534e39718004b40d22 Mon Sep 17 00:00:00 2001 From: Aleksandar Grbic Date: Fri, 9 Oct 2026 08:58:51 +0200 Subject: [PATCH 1/3] fix(deps): patch handlebars to 4.7.10 instead of ignoring its advisories 4.7.10 is the only release that fixes two critical JavaScript-injection advisories. It is exempted from the 7-day quarantine, like form-data was, and the three osv ignores are removed. --- apps/api/bun.lock | 40 +++++++-------------------------------- apps/api/bunfig.toml | 5 +++++ apps/api/osv-scanner.toml | 30 ----------------------------- apps/api/package.json | 2 +- 4 files changed, 13 insertions(+), 64 deletions(-) diff --git a/apps/api/bun.lock b/apps/api/bun.lock index 3894e8c..91b8bcf 100644 --- a/apps/api/bun.lock +++ b/apps/api/bun.lock @@ -26,7 +26,7 @@ "elysia": "1.4.30", "elysia-rate-limit": "4.6.3", "fs-extra": "11.4.1", - "handlebars": "4.7.9", + "handlebars": "4.7.10", "ioredis": "5.11.1", "nodemailer": "10.0.13", "openai": "7.27.0", @@ -614,7 +614,7 @@ "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.71.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.71.0", "@typescript-eslint/type-utils": "8.71.0", "@typescript-eslint/utils": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.71.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-pqcS9c1HxZTHt7End4nXqd0s5lJrrFzrgCkKFJrsbUnaL6M3+6oBFZaslg6Gjsl3argl2DDRFROnXARaZ2e4Nw=="], - "@typescript-eslint/parser": ["@typescript-eslint/parser@8.69.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/typescript-estree": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw=="], + "@typescript-eslint/parser": ["@typescript-eslint/parser@8.71.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.71.0", "@typescript-eslint/types": "8.71.0", "@typescript-eslint/typescript-estree": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-CG4nPk1f2zc8yw4pALqHsFYH2hdo+h1T9daSp21+Hnxi9LOE3GT9hAfTKJCBXVNM2GmYs1eMEP615wPoeOgk3A=="], "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.71.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.71.0", "@typescript-eslint/types": "^8.71.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-aABjw5rjBacYONVPaPiWOCjJu0vEF4a25iQuodlmQYL1trtLZ0X/y+2Vzl3BKI1odM4LnwLE1oUDXYp1wzx1TQ=="], @@ -630,7 +630,7 @@ "@typescript-eslint/utils": ["@typescript-eslint/utils@8.61.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@typescript-eslint/scope-manager": "8.61.1", "@typescript-eslint/types": "8.61.1", "@typescript-eslint/typescript-estree": "8.61.1" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA=="], - "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w=="], + "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-8eQ9R218XORK+KLosnf4bu/QsUXvUyVwTbArg7/0NMB1Pu87OJKvj4nhFblkYE8gQV73mW1dx1ptlPCkwRGa7A=="], "@ucast/core": ["@ucast/core@2.0.0", "", {}, "sha512-4XVx6LzPXZGvnZO5jp39cm/G4UvuwvEdtmg+9+4+zl6uFkCcB7UJacvtMYeBE56GJVT99Zqy6Pii7dGJq3Kz9Q=="], @@ -944,7 +944,7 @@ "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="], - "handlebars": ["handlebars@4.7.9", "", { "dependencies": { "minimist": "^1.2.5", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0" }, "optionalDependencies": { "uglify-js": "^3.1.4" }, "bin": { "handlebars": "bin/handlebars" } }, "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ=="], + "handlebars": ["handlebars@4.7.10", "", { "dependencies": { "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0" }, "optionalDependencies": { "uglify-js": "^3.1.4" }, "bin": { "handlebars": "bin/handlebars" } }, "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg=="], "has-bigints": ["has-bigints@1.1.0", "", {}, "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg=="], @@ -1506,17 +1506,11 @@ "@types/pg-pool/@types/pg": ["@types/pg@8.20.0", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/parser": ["@typescript-eslint/parser@8.71.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.71.0", "@typescript-eslint/types": "8.71.0", "@typescript-eslint/typescript-estree": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-CG4nPk1f2zc8yw4pALqHsFYH2hdo+h1T9daSp21+Hnxi9LOE3GT9hAfTKJCBXVNM2GmYs1eMEP615wPoeOgk3A=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0" } }, "sha512-gWF0BhUcnjZxSpLE8ngS/59n2SB0J3YqRxvX1+2aoRJk9hNtHSLOV+TcarFiOr5ipXm3yc1QrI4c9YZc8zyCxw=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-8eQ9R218XORK+KLosnf4bu/QsUXvUyVwTbArg7/0NMB1Pu87OJKvj4nhFblkYE8gQV73mW1dx1ptlPCkwRGa7A=="], - - "@typescript-eslint/parser/@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.69.0", "", { "dependencies": { "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0" } }, "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ=="], + "@typescript-eslint/parser/@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0" } }, "sha512-gWF0BhUcnjZxSpLE8ngS/59n2SB0J3YqRxvX1+2aoRJk9hNtHSLOV+TcarFiOr5ipXm3yc1QrI4c9YZc8zyCxw=="], - "@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.69.0", "", {}, "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA=="], - - "@typescript-eslint/parser/@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.69.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.69.0", "@typescript-eslint/tsconfig-utils": "8.69.0", "@typescript-eslint/types": "8.69.0", "@typescript-eslint/visitor-keys": "8.69.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w=="], + "@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], "@typescript-eslint/project-service/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], @@ -1526,13 +1520,11 @@ "@typescript-eslint/typescript-estree/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], - "@typescript-eslint/typescript-estree/@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-8eQ9R218XORK+KLosnf4bu/QsUXvUyVwTbArg7/0NMB1Pu87OJKvj4nhFblkYE8gQV73mW1dx1ptlPCkwRGa7A=="], - "@typescript-eslint/typescript-estree/semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="], "@typescript-eslint/utils/@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.61.1", "", { "dependencies": { "@typescript-eslint/project-service": "8.61.1", "@typescript-eslint/tsconfig-utils": "8.61.1", "@typescript-eslint/types": "8.61.1", "@typescript-eslint/visitor-keys": "8.61.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg=="], - "@typescript-eslint/visitor-keys/@typescript-eslint/types": ["@typescript-eslint/types@8.69.0", "", {}, "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA=="], + "@typescript-eslint/visitor-keys/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], "axios/https-proxy-agent": ["https-proxy-agent@5.0.1", "", { "dependencies": { "agent-base": "6", "debug": "4" } }, "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA=="], @@ -1576,8 +1568,6 @@ "tsx/esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="], - "typescript-eslint/@typescript-eslint/parser": ["@typescript-eslint/parser@8.71.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.71.0", "@typescript-eslint/types": "8.71.0", "@typescript-eslint/typescript-estree": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-CG4nPk1f2zc8yw4pALqHsFYH2hdo+h1T9daSp21+Hnxi9LOE3GT9hAfTKJCBXVNM2GmYs1eMEP615wPoeOgk3A=="], - "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.18.20", "", { "os": "android", "cpu": "arm" }, "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw=="], "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.18.20", "", { "os": "android", "cpu": "arm64" }, "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ=="], @@ -1686,18 +1676,8 @@ "@sentry/bundler-plugins/oxc-parser/@oxc-project/types": ["@oxc-project/types@0.152.0", "", {}, "sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/scope-manager/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], - "@typescript-eslint/eslint-plugin/@typescript-eslint/visitor-keys/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], - - "@typescript-eslint/parser/@typescript-eslint/typescript-estree/@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.69.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.69.0", "@typescript-eslint/types": "^8.69.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg=="], - - "@typescript-eslint/parser/@typescript-eslint/typescript-estree/@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.69.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ=="], - - "@typescript-eslint/parser/@typescript-eslint/typescript-estree/semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="], - "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.61.1", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.61.1", "@typescript-eslint/types": "^8.61.1", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA=="], "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.61.1", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg=="], @@ -1772,12 +1752,6 @@ "tsx/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="], - "typescript-eslint/@typescript-eslint/parser/@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "@typescript-eslint/visitor-keys": "8.71.0" } }, "sha512-gWF0BhUcnjZxSpLE8ngS/59n2SB0J3YqRxvX1+2aoRJk9hNtHSLOV+TcarFiOr5ipXm3yc1QrI4c9YZc8zyCxw=="], - - "typescript-eslint/@typescript-eslint/parser/@typescript-eslint/types": ["@typescript-eslint/types@8.71.0", "", {}, "sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ=="], - - "typescript-eslint/@typescript-eslint/parser/@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.71.0", "", { "dependencies": { "@typescript-eslint/types": "8.71.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-8eQ9R218XORK+KLosnf4bu/QsUXvUyVwTbArg7/0NMB1Pu87OJKvj4nhFblkYE8gQV73mW1dx1ptlPCkwRGa7A=="], - "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/project-service/@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.65.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg=="], "@typescript-eslint/utils/@typescript-eslint/typescript-estree/@typescript-eslint/project-service/@typescript-eslint/types": ["@typescript-eslint/types@8.65.0", "", {}, "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg=="], diff --git a/apps/api/bunfig.toml b/apps/api/bunfig.toml index 4ad4901..9617fc0 100644 --- a/apps/api/bunfig.toml +++ b/apps/api/bunfig.toml @@ -50,6 +50,11 @@ minimumReleaseAgeExcludes = [ # we override `form-data` directly to clear `bun audit`. The patched release # is <7 days old, so exempt it from the quarantine window. "form-data", + # handlebars 4.7.10 (2026-10-05) is the only release patching two critical + # JavaScript-injection advisories (GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f) + # and GHSA-xw65-4hp5-5hc7. A known critical fix outweighs the quarantine + # window for this one release; remove the entry once it is past 7 days. + "handlebars", ] [test] diff --git a/apps/api/osv-scanner.toml b/apps/api/osv-scanner.toml index 9434a9d..b628625 100644 --- a/apps/api/osv-scanner.toml +++ b/apps/api/osv-scanner.toml @@ -34,33 +34,3 @@ the @boring-stack-pkg ESLint plugins: lint-time tooling, never in the production image or reached by request input. Remove once braces is patched. """ -# Handlebars has no release that is both patched and past the 7-day quarantine -# (4.7.10 was published 2026-10-05, eligible from 2026-10-12). Bump -# handlebars to 4.7.10 when it ages in, then drop these three entries. -[[IgnoredVulns]] -id = "GHSA-8r5x-fm3f-whwj" -ignoreUntil = "2026-10-16T00:00:00Z" -reason = """ -Handlebars compile-path JavaScript injection (bypass of CVE-2026-33937), fixed -in 4.7.10. Templates are compiled only at build time (src/templates/email/build.ts, -preview.ts) from files we own; runtime rendering uses precompiled templates via -handlebars/runtime. No user-supplied template source reaches compile(). -""" - -[[IgnoredVulns]] -id = "GHSA-p8wg-vrv2-v86f" -ignoreUntil = "2026-10-16T00:00:00Z" -reason = """ -Handlebars own-property check bypass leading to JavaScript injection, fixed in -4.7.10. Same usage as GHSA-8r5x-fm3f-whwj: compile() runs only over owned -templates at build time; no attacker-controlled template or helper source. -""" - -[[IgnoredVulns]] -id = "GHSA-xw65-4hp5-5hc7" -ignoreUntil = "2026-10-16T00:00:00Z" -reason = """ -Handlebars unsafe inline embedding of precompiled templates, fixed in 4.7.10. -Only precompiled, repo-owned templates are embedded; no template content is -derived from request input. Same expiry as GHSA-8r5x-fm3f-whwj. -""" diff --git a/apps/api/package.json b/apps/api/package.json index 1d6d230..20d954c 100644 --- a/apps/api/package.json +++ b/apps/api/package.json @@ -76,7 +76,7 @@ "elysia": "1.4.30", "elysia-rate-limit": "4.6.3", "fs-extra": "11.4.1", - "handlebars": "4.7.9", + "handlebars": "4.7.10", "ioredis": "5.11.1", "nodemailer": "10.0.13", "openai": "7.27.0", From f524d06e657a6661b8f34c0406e30034895ef008 Mon Sep 17 00:00:00 2001 From: Aleksandar Grbic Date: Fri, 9 Oct 2026 08:58:52 +0200 Subject: [PATCH 2/3] fix(deps): declare sharp 0.35.5 directly in docs and site The override already installed 0.35.5, but Dependabot reads the direct dependency and kept GHSA-wq5f-xc86-pv6w open. --- apps/docs/bun.lock | 5 +---- apps/docs/package.json | 2 +- apps/site/bun.lock | 2 +- apps/site/package.json | 2 +- 4 files changed, 4 insertions(+), 7 deletions(-) diff --git a/apps/docs/bun.lock b/apps/docs/bun.lock index 6b0de73..fa20db9 100644 --- a/apps/docs/bun.lock +++ b/apps/docs/bun.lock @@ -18,7 +18,7 @@ "react-dom": "19.3.0", "reading-time": "1.5.0", "remark-gfm": "4.0.1", - "sharp": "0.35.4", + "sharp": "0.35.5", "tailwindcss": "4.3.3", "ws": "8.22.0", }, @@ -499,7 +499,6 @@ "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="], - "@types/react-dom": ["@types/react-dom@19.3.0", "", { "peerDependencies": { "@types/react": "^19.3.0" } }, "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q=="], "@types/sax": ["@types/sax@1.2.7", "", { "dependencies": { "@types/node": "*" } }, "sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A=="], @@ -638,8 +637,6 @@ "csso": ["csso@5.0.5", "", { "dependencies": { "css-tree": "~2.2.0" } }, "sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ=="], - "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="], - "cytoscape": ["cytoscape@3.34.0", "", {}, "sha512-62rNSrioXw93uliKFBwjukeQyeWwH2PqDrTac31r2P6464u3AUvTk0xS4LVvT251g7IgkFunrI48ZEZGjywSOg=="], "cytoscape-cose-bilkent": ["cytoscape-cose-bilkent@4.1.0", "", { "dependencies": { "cose-base": "^1.0.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ=="], diff --git a/apps/docs/package.json b/apps/docs/package.json index e9e66e3..207579c 100644 --- a/apps/docs/package.json +++ b/apps/docs/package.json @@ -49,7 +49,7 @@ "react-dom": "19.3.0", "reading-time": "1.5.0", "remark-gfm": "4.0.1", - "sharp": "0.35.4", + "sharp": "0.35.5", "tailwindcss": "4.3.3", "ws": "8.22.0" }, diff --git a/apps/site/bun.lock b/apps/site/bun.lock index e8078f5..7d206fe 100644 --- a/apps/site/bun.lock +++ b/apps/site/bun.lock @@ -9,7 +9,7 @@ "@fontsource/manrope": "5.3.0", "astro": "7.3.5", "satori": "0.34.0", - "sharp": "0.35.4", + "sharp": "0.35.5", }, "devDependencies": { "@astrojs/check": "0.9.10", diff --git a/apps/site/package.json b/apps/site/package.json index 75319bd..45845a5 100644 --- a/apps/site/package.json +++ b/apps/site/package.json @@ -27,7 +27,7 @@ "@fontsource/manrope": "5.3.0", "astro": "7.3.5", "satori": "0.34.0", - "sharp": "0.35.4" + "sharp": "0.35.5" }, "devDependencies": { "@astrojs/check": "0.9.10", From 3f69548975e35715c831516ffe8bd734929bf4bb Mon Sep 17 00:00:00 2001 From: Aleksandar Grbic Date: Fri, 9 Oct 2026 08:58:52 +0200 Subject: [PATCH 3/3] fix(agent): keep sandbox passwords out of Docker arguments The isolated runtime passed the Postgres and Valkey passwords as docker arguments. They now travel in the Docker client's environment through -e NAME, so they never reach a process list or an error message. Resolves CodeQL js/clear-text-logging. --- tools/agent-evals/isolated/docker.ts | 9 +- tools/agent-evals/isolated/runtime.ts | 188 ++++++++++++++------------ 2 files changed, 108 insertions(+), 89 deletions(-) diff --git a/tools/agent-evals/isolated/docker.ts b/tools/agent-evals/isolated/docker.ts index dcc64f2..00665c0 100644 --- a/tools/agent-evals/isolated/docker.ts +++ b/tools/agent-evals/isolated/docker.ts @@ -23,14 +23,21 @@ function redactedTail(stderr: string, args: readonly string[]): string { return tail.replace(/\s+/g, " "); } +/** + * Secrets travel in the Docker client's environment, never in its arguments: + * `-e NAME` without a value makes Docker read NAME from that environment, so + * a password never appears in a process list or in an argument echo. + */ export async function docker( root: string, args: string[], - timeoutMs = 120_000 + timeoutMs = 120_000, + secrets: Readonly> = {} ): Promise { const result = await runProcess(["docker", ...args], { cwd: root, timeoutMs, + env: { ...process.env, ...secrets }, }); if (result.status !== "completed" || result.code !== 0) { diff --git a/tools/agent-evals/isolated/runtime.ts b/tools/agent-evals/isolated/runtime.ts index 6f7b7a5..880cde7 100644 --- a/tools/agent-evals/isolated/runtime.ts +++ b/tools/agent-evals/isolated/runtime.ts @@ -61,97 +61,109 @@ export async function withIsolatedRuntime( 900_000 ); await docker(root, runnerArguments(name, image)); - await docker(root, [ - "run", - "-d", - "--name", - state.postgres, - "--network", - `container:${name}`, - "--read-only", - "--cap-drop", - "ALL", - "--security-opt", - "no-new-privileges", - "--user", - "postgres", - "--pids-limit", - "128", - "--memory", - "1g", - "--cpus", - "1", - "--tmpfs", - "/var/lib/postgresql/data:rw,nosuid,nodev,size=512m,mode=1777", - "--tmpfs", - "/var/run/postgresql:rw,nosuid,nodev,mode=1777", - "--tmpfs", - "/tmp:rw,nosuid,nodev,size=64m,mode=1777", - "-e", - "PGDATA=/var/lib/postgresql/data/pgdata", - "-e", - "POSTGRES_USER=app", - "-e", - `POSTGRES_PASSWORD=${state.password}`, - "-e", - "POSTGRES_DB=app", - selectImage(pins, "postgres"), - ]); - await docker(root, [ - "run", - "-d", - "--name", - state.valkey, - "--network", - `container:${name}`, - "--read-only", - "--cap-drop", - "ALL", - "--security-opt", - "no-new-privileges", - "--user", - "valkey", - "--pids-limit", - "64", - "--memory", - "256m", - "--cpus", - "1", - selectImage(pins, "valkey/valkey"), - "valkey-server", - "--save", - "", - "--appendonly", - "no", - "--requirepass", - state.valkeyPassword, - ]); + await docker( + root, + [ + "run", + "-d", + "--name", + state.postgres, + "--network", + `container:${name}`, + "--read-only", + "--cap-drop", + "ALL", + "--security-opt", + "no-new-privileges", + "--user", + "postgres", + "--pids-limit", + "128", + "--memory", + "1g", + "--cpus", + "1", + "--tmpfs", + "/var/lib/postgresql/data:rw,nosuid,nodev,size=512m,mode=1777", + "--tmpfs", + "/var/run/postgresql:rw,nosuid,nodev,mode=1777", + "--tmpfs", + "/tmp:rw,nosuid,nodev,size=64m,mode=1777", + "-e", + "PGDATA=/var/lib/postgresql/data/pgdata", + "-e", + "POSTGRES_USER=app", + "-e", + "POSTGRES_PASSWORD", + "-e", + "POSTGRES_DB=app", + selectImage(pins, "postgres"), + ], + undefined, + { POSTGRES_PASSWORD: state.password } + ); + await docker( + root, + [ + "run", + "-d", + "--name", + state.valkey, + "--network", + `container:${name}`, + "--read-only", + "--cap-drop", + "ALL", + "--security-opt", + "no-new-privileges", + "--user", + "valkey", + "--pids-limit", + "64", + "--memory", + "256m", + "--cpus", + "1", + "-e", + "VALKEY_PASSWORD", + "--entrypoint", + "sh", + selectImage(pins, "valkey/valkey"), + "-c", + 'exec valkey-server --save "" --appendonly no --requirepass "$VALKEY_PASSWORD"', + ], + undefined, + { VALKEY_PASSWORD: state.valkeyPassword } + ); for (let attempt = 0; ; attempt++) { try { - await docker(root, [ - "exec", - "-e", - `PGPASSWORD=${state.password}`, - state.postgres, - "psql", - "-h", - "127.0.0.1", - "-U", - "app", - "-d", - "app", - "-c", - "SELECT 1", - ]); - await docker(root, [ - "exec", - state.valkey, - "valkey-cli", - "-a", - state.valkeyPassword, - "ping", - ]); + await docker( + root, + [ + "exec", + "-e", + "PGPASSWORD", + state.postgres, + "psql", + "-h", + "127.0.0.1", + "-U", + "app", + "-d", + "app", + "-c", + "SELECT 1", + ], + undefined, + { PGPASSWORD: state.password } + ); + await docker( + root, + ["exec", "-e", "REDISCLI_AUTH", state.valkey, "valkey-cli", "ping"], + undefined, + { REDISCLI_AUTH: state.valkeyPassword } + ); break; } catch { if (attempt >= 60) {