From 84d3a138b46ef1bca59b514119c8148431e2ca30 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 7 Oct 2026 07:03:10 +0000 Subject: [PATCH] fix(deps): close patchable prod audit findings Tighten pnpm overrides for proxy-addr, compression, source-map-js, ip-address, @grpc/grpc-js, brace-expansion, and e2b's undici8 alias. Bump hono and nodemailer to patched ranges. Leave braces/node-forge unpatched (no upstream fix). Co-Authored-By: Cursor Co-authored-by: Gaffer.dev --- apps/api/package.json | 2 +- infra/sandboxes/supervisor/package.json | 2 +- infra/updater/package.json | 2 +- package.json | 10 +- packages/adapters/package.json | 2 +- pnpm-lock.yaml | 130 ++++++++++++------------ 6 files changed, 79 insertions(+), 69 deletions(-) diff --git a/apps/api/package.json b/apps/api/package.json index 04004fa9..6bf93a6c 100644 --- a/apps/api/package.json +++ b/apps/api/package.json @@ -19,7 +19,7 @@ "@sentrabot/core": "workspace:*", "@sentrabot/db": "workspace:*", "@sentrabot/memory": "workspace:*", - "hono": "^4.9.6" + "hono": "^4.13.7" }, "devDependencies": { "typescript": "^5.9.2", diff --git a/infra/sandboxes/supervisor/package.json b/infra/sandboxes/supervisor/package.json index b793e147..a199dc81 100644 --- a/infra/sandboxes/supervisor/package.json +++ b/infra/sandboxes/supervisor/package.json @@ -13,7 +13,7 @@ "@hono/node-server": "^1.19.1", "@sentrabot/core": "workspace:*", "dockerode": "^4.0.7", - "hono": "^4.9.6", + "hono": "^4.13.7", "tsx": "^4.20.5", "zod": "^4.1.5" }, diff --git a/infra/updater/package.json b/infra/updater/package.json index 8eccc317..59dfbf17 100644 --- a/infra/updater/package.json +++ b/infra/updater/package.json @@ -14,7 +14,7 @@ "@hono/node-server": "^1.19.1", "@sentrabot/contracts": "workspace:*", "@sentrabot/core": "workspace:*", - "hono": "^4.9.6", + "hono": "^4.13.7", "tsx": "^4.20.5" }, "devDependencies": { diff --git a/package.json b/package.json index 11fcb663..009e4c88 100644 --- a/package.json +++ b/package.json @@ -46,7 +46,15 @@ "uuid": "14.0.2", "undici@6.28.0": "6.28.1", "undici@7.29.0": "7.29.1", - "undici@8.10.0": "8.10.2" + "undici@^8.0.0": "8.10.2", + "proxy-addr": "2.0.8", + "compression": "1.8.2", + "source-map-js": ">=1.2.2", + "ip-address": ">=10.7.1", + "@grpc/grpc-js": ">=1.14.5", + "brace-expansion@^2": "2.1.7", + "brace-expansion@^5": "5.0.12", + "undici8": "npm:undici@8.10.2" } } } diff --git a/packages/adapters/package.json b/packages/adapters/package.json index 34c95828..9383d58d 100644 --- a/packages/adapters/package.json +++ b/packages/adapters/package.json @@ -27,7 +27,7 @@ "graphile-worker": "^0.17.3", "jsdom": "^30.0.1", "koffi": "^2.9.0", - "nodemailer": "^10.0.2", + "nodemailer": "^10.0.9", "pg": "^8.16.3", "sharp": "^0.35.5", "shell-quote": "1.11.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3002f937..5823afe7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,7 +12,15 @@ overrides: uuid: 14.0.2 undici@6.28.0: 6.28.1 undici@7.29.0: 7.29.1 - undici@8.10.0: 8.10.2 + undici@^8.0.0: 8.10.2 + proxy-addr: 2.0.8 + compression: 1.8.2 + source-map-js: '>=1.2.2' + ip-address: '>=10.7.1' + '@grpc/grpc-js': '>=1.14.5' + brace-expansion@^2: 2.1.7 + brace-expansion@^5: 5.0.12 + undici8: npm:undici@8.10.2 importers: @@ -44,7 +52,7 @@ importers: dependencies: '@hono/node-server': specifier: ^1.19.1 - version: 1.19.17(hono@4.13.5) + version: 1.19.17(hono@4.13.13) '@orpc/server': specifier: ^1.15.0 version: 1.15.0(@opentelemetry/api@1.9.1)(ws@8.21.3) @@ -70,8 +78,8 @@ importers: specifier: workspace:* version: link:../../packages/memory hono: - specifier: ^4.9.6 - version: 4.13.5 + specifier: ^4.13.7 + version: 4.13.13 devDependencies: typescript: specifier: ^5.9.2 @@ -383,7 +391,7 @@ importers: dependencies: '@hono/node-server': specifier: ^1.19.1 - version: 1.19.17(hono@4.13.5) + version: 1.19.17(hono@4.13.13) '@sentrabot/core': specifier: workspace:* version: link:../../../packages/core @@ -391,8 +399,8 @@ importers: specifier: ^4.0.7 version: 4.0.12 hono: - specifier: ^4.9.6 - version: 4.13.5 + specifier: ^4.13.7 + version: 4.13.13 tsx: specifier: ^4.20.5 version: 4.23.13 @@ -414,7 +422,7 @@ importers: dependencies: '@hono/node-server': specifier: ^1.19.1 - version: 1.19.17(hono@4.13.5) + version: 1.19.17(hono@4.13.13) '@sentrabot/contracts': specifier: workspace:* version: link:../../packages/contracts @@ -422,8 +430,8 @@ importers: specifier: workspace:* version: link:../../packages/core hono: - specifier: ^4.9.6 - version: 4.13.5 + specifier: ^4.13.7 + version: 4.13.13 tsx: specifier: ^4.20.5 version: 4.23.13 @@ -505,8 +513,8 @@ importers: specifier: ^2.9.0 version: 2.16.3 nodemailer: - specifier: ^10.0.2 - version: 10.0.2 + specifier: ^10.0.9 + version: 10.0.15 pg: specifier: ^8.16.3 version: 8.23.0 @@ -517,7 +525,7 @@ importers: specifier: 1.11.0 version: 1.11.0 undici: - specifier: ^8.10.2 + specifier: 8.10.2 version: 8.10.2 zod: specifier: ^4.1.5 @@ -699,7 +707,7 @@ importers: dependencies: '@hono/node-server': specifier: ^1.19.1 - version: 1.19.17(hono@4.13.5) + version: 1.19.17(hono@4.13.13) '@sentrabot/adapter-kit': specifier: workspace:* version: link:../adapter-kit @@ -2132,8 +2140,8 @@ packages: '@graphile/logger@0.2.0': resolution: {integrity: sha512-jjcWBokl9eb1gVJ85QmoaQ73CQ52xAaOCF29ukRbYNl6lY+ts0ErTaDYOBlejcbUs2OpaiqYLO5uDhyLFzWw4w==} - '@grpc/grpc-js@1.14.4': - resolution: {integrity: sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==} + '@grpc/grpc-js@1.14.5': + resolution: {integrity: sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==} engines: {node: '>=12.10.0'} '@grpc/proto-loader@0.7.15': @@ -4271,11 +4279,11 @@ packages: brace-expansion@1.1.18: resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.7: + resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -4559,8 +4567,8 @@ packages: resolution: {integrity: sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==} engines: {node: '>= 0.6'} - compression@1.8.1: - resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} + compression@1.8.2: + resolution: {integrity: sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==} engines: {node: '>= 0.8.0'} concat-map@0.0.1: @@ -5759,8 +5767,8 @@ packages: resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==} engines: {node: '>=0.10.0'} - hono@4.13.5: - resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} hosted-git-info@4.1.0: @@ -5858,8 +5866,8 @@ packages: invariant@2.2.4: resolution: {integrity: sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==} - ip-address@10.7.0: - resolution: {integrity: sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==} + ip-address@10.7.3: + resolution: {integrity: sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -6752,8 +6760,8 @@ packages: resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==} engines: {node: '>=18'} - nodemailer@10.0.2: - resolution: {integrity: sha512-83mO0TnWXySiJXdMAIUYmlXYdJ2KUq/w8EJgc4ogKU2UssaHf7ZPeuHcb4YCxeNiM0DDshnm291U0/ClrSZZsg==} + nodemailer@10.0.15: + resolution: {integrity: sha512-EUqp5PhtcsYXs9Fq/lS7s/8zlTrnBqmzZWzFFROrNikMiz+om/YRKMwqN907t+0A1KKyT8jd39CBUbFZmaZmcA==} engines: {node: '>=20.0.0'} nopt@9.0.0: @@ -7168,8 +7176,8 @@ packages: resolution: {integrity: sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==} engines: {node: '>=12.0.0'} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} proxy-from-env@2.1.0: @@ -7768,8 +7776,8 @@ packages: resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==} engines: {node: '>=10.0.0'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map-support@0.5.21: @@ -8147,10 +8155,6 @@ packages: resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} - undici@8.10.0: - resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} - engines: {node: '>=22.19.0'} - undici@8.10.2: resolution: {integrity: sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==} engines: {node: '>=22.19.0'} @@ -9933,7 +9937,7 @@ snapshots: bplist-parser: 0.3.2 chalk: 4.1.2 ci-info: 3.9.0 - compression: 1.8.1 + compression: 1.8.2 connect: 3.7.0 debug: 4.4.3 dnssd-advertise: 1.1.6 @@ -10298,7 +10302,7 @@ snapshots: '@graphile/logger@0.2.0': {} - '@grpc/grpc-js@1.14.4': + '@grpc/grpc-js@1.14.5': dependencies: '@grpc/proto-loader': 0.8.1 '@js-sdsl/ordered-map': 4.4.2 @@ -10317,9 +10321,9 @@ snapshots: protobufjs: 7.6.6 yargs: 17.7.3 - '@hono/node-server@1.19.17(hono@4.13.5)': + '@hono/node-server@1.19.17(hono@4.13.13)': dependencies: - hono: 4.13.5 + hono: 4.13.13 '@iarna/toml@2.2.5': {} @@ -10696,7 +10700,7 @@ snapshots: '@modelcontextprotocol/sdk@1.31.0(zod@4.5.4)': dependencies: - '@hono/node-server': 1.19.17(hono@4.13.5) + '@hono/node-server': 1.19.17(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -10706,7 +10710,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1 express-rate-limit: 8.7.0(express@5.2.1) - hono: 4.13.5 + hono: 4.13.13 jose: 6.2.10 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -10874,7 +10878,7 @@ snapshots: '@opentelemetry/otlp-grpc-exporter-base@0.221.0(@opentelemetry/api@1.9.1)': dependencies: - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@opentelemetry/api': 1.9.1 '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) @@ -11913,7 +11917,7 @@ snapshots: jiti: 2.7.0 lightningcss: 1.32.0 magic-string: 0.30.21 - source-map-js: 1.2.1 + source-map-js: 1.2.2 tailwindcss: 4.3.3 '@tailwindcss/oxide-android-arm64@4.3.3': @@ -12790,11 +12794,11 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.4: + brace-expansion@2.1.7: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -13090,11 +13094,12 @@ snapshots: dependencies: mime-db: 1.54.0 - compression@1.8.1: + compression@1.8.2: dependencies: bytes: 3.1.2 compressible: 2.0.18 debug: 2.6.9 + destroy: 1.2.0 negotiator: 0.6.4 on-headers: 1.1.0 safe-buffer: 5.2.1 @@ -13221,7 +13226,7 @@ snapshots: css-tree@3.2.1: dependencies: mdn-data: 2.27.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css-what@6.2.2: {} @@ -13519,7 +13524,7 @@ snapshots: dockerode@4.0.12: dependencies: '@balena/dockerignore': 1.0.2 - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@grpc/proto-loader': 0.7.15 docker-modem: 5.0.7 protobufjs: 7.6.6 @@ -13578,7 +13583,7 @@ snapshots: tar: 7.5.22 undici: 7.29.1 optionalDependencies: - undici8: undici@8.10.0 + undici8: undici@8.10.2 eastasianwidth@0.2.0: {} @@ -14105,7 +14110,7 @@ snapshots: dependencies: debug: 4.4.3 express: 5.2.1 - ip-address: 10.7.0 + ip-address: 10.7.3 transitivePeerDependencies: - supports-color @@ -14130,7 +14135,7 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.16.0 range-parser: 1.3.0 router: 2.2.0 @@ -14587,7 +14592,7 @@ snapshots: dependencies: parse-passwd: 1.0.0 - hono@4.13.5: {} + hono@4.13.13: {} hosted-git-info@4.1.0: dependencies: @@ -14693,7 +14698,7 @@ snapshots: dependencies: loose-envify: 1.4.0 - ip-address@10.7.0: {} + ip-address@10.7.3: {} ipaddr.js@1.9.1: {} @@ -15682,7 +15687,7 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: @@ -15690,11 +15695,11 @@ snapshots: minimatch@5.1.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.7 minimist@1.2.8: {} @@ -15793,7 +15798,7 @@ snapshots: node-releases@2.0.54: {} - nodemailer@10.0.2: {} + nodemailer@10.0.15: {} nopt@9.0.0: dependencies: @@ -16076,7 +16081,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 postgres-array@2.0.0: {} @@ -16190,7 +16195,7 @@ snapshots: '@types/node': 24.13.3 long: 5.3.2 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -16983,7 +16988,7 @@ snapshots: transitivePeerDependencies: - supports-color - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map-support@0.5.21: dependencies: @@ -17387,9 +17392,6 @@ snapshots: undici@7.29.1: {} - undici@8.10.0: - optional: true - undici@8.10.2: {} unicode-canonical-property-names-ecmascript@2.0.1: {}