From 08cc8bb2c0098fc50237cca6f1a5166cf5e01e7d Mon Sep 17 00:00:00 2001 From: Michael Gartner Date: Mon, 7 Sep 2026 00:14:26 -0600 Subject: [PATCH] ENG-2236 Update tooling dependencies for five reviewed security alerts --- pnpm-lock.yaml | 130 ++++++++++++++++++++------------------------ pnpm-workspace.yaml | 6 ++ 2 files changed, 66 insertions(+), 70 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8393d9435..1b07508f0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -63,6 +63,11 @@ catalogs: version: 18.2.0 overrides: + tar@>=7.0.0 <7.5.19: 7.5.19 + browserslist@>=4.0.0 <4.28.7: 4.28.7 + brace-expansion@>=1.0.0 <1.1.18: 1.1.18 + brace-expansion@>=2.0.0 <2.1.4: 2.1.4 + js-yaml@>=4.0.0 <4.3.1: 4.3.1 '@types/react-dom@18.2.17>@types/react': 18.2.21 '@types/react-vertical-timeline-component@3.3.6>@types/react': 18.2.21 react-charts@3.0.0-beta.57>@types/react: 18.2.21 @@ -5703,6 +5708,11 @@ packages: engines: {node: '>=6.0.0'} hasBin: true + baseline-browser-mapping@2.11.21: + resolution: {integrity: sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==} + engines: {node: '>=6.0.0'} + hasBin: true + basic-ftp@5.0.5: resolution: {integrity: sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==} engines: {node: '>=10.0.0'} @@ -5747,11 +5757,11 @@ packages: bowser@2.12.1: resolution: {integrity: sha512-z4rE2Gxh7tvshQ4hluIT7XcFrgLIQaw9X3A+kTTRdovCz5PMukm/0QC/BKSYPj3omF5Qfypn9O/c5kgpmvYUCw==} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.0.2: - resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} brace-expansion@5.0.9: resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} @@ -5761,8 +5771,8 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - browserslist@4.25.4: - resolution: {integrity: sha512-4jYpcjabC606xJ3kw2QwGEZKX0Aw7sgQdZCvIK9dhVSPh76BKo+C+btT1RRofH7B+8iNpEbgGNVWiLki5q93yg==} + browserslist@4.28.7: + resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -5821,6 +5831,9 @@ packages: caniuse-lite@1.0.30001739: resolution: {integrity: sha512-y+j60d6ulelrNSwpPyrHdl+9mJnQzHBr08xm48Qno0nSk4h3Qojh+ziv2qE6rXf4k3tadF4o1J/1tAbVm1NtnA==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} + canvas-size@1.2.6: resolution: {integrity: sha512-x2iVHOrZ5x9V0Hwx6kBz+Yxf/VCAII+jrD6WLjJbytJLozHq/oDJjEva432Os0eHxWMFR0vYlLJwTr6QxyxQqw==} @@ -6627,8 +6640,8 @@ packages: ee-first@1.1.1: resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==} - electron-to-chromium@1.5.214: - resolution: {integrity: sha512-TpvUNdha+X3ybfU78NoQatKvQEm1oq3lf2QbnmCEdw+Bd9RuIAY+hJTvq1avzHM0f7EJfnH3vbCnbzKzisc/9Q==} + electron-to-chromium@1.5.422: + resolution: {integrity: sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==} emoji-regex@10.6.0: resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==} @@ -7917,14 +7930,6 @@ packages: resolution: {integrity: sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==} hasBin: true - js-yaml@4.1.0: - resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==} - hasBin: true - - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} - hasBin: true - js-yaml@4.3.1: resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true @@ -8713,8 +8718,9 @@ packages: resolution: {integrity: sha512-Cov028YhBZ5aB7MdMWJEmwyBig43aGL5WT4vdoB28Oitau1zZAcHUn8Sgfk9HM33TqhtLJ9PlM/O0Mv+QpV/4Q==} engines: {node: '>=8.9.4'} - node-releases@2.0.19: - resolution: {integrity: sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==} + node-releases@2.0.54: + resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==} + engines: {node: '>=18'} nopt@8.1.0: resolution: {integrity: sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==} @@ -10380,14 +10386,9 @@ packages: tar-stream@3.1.7: resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==} - tar@7.5.13: - resolution: {integrity: sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==} - engines: {node: '>=18'} - - tar@7.5.7: - resolution: {integrity: sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==} + tar@7.5.19: + resolution: {integrity: sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==} engines: {node: '>=18'} - deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me test-exclude@6.0.0: resolution: {integrity: sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==} @@ -10825,11 +10826,11 @@ packages: resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==} engines: {node: '>= 0.8'} - update-browserslist-db@1.1.3: - resolution: {integrity: sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==} + update-browserslist-db@1.3.2: + resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: 4.28.7 update-check@1.5.4: resolution: {integrity: sha512-5YHsflzHP4t1G+8WGPlvKbJEbAJGCgw+Em+dGR1KmBUbr1J36SJBqlHLjR7oob7sco5hWHGQVcr9B2poIVDDTQ==} @@ -11913,7 +11914,7 @@ snapshots: dependencies: '@babel/compat-data': 7.28.0 '@babel/helper-validator-option': 7.27.1 - browserslist: 4.25.4 + browserslist: 4.28.7 lru-cache: 5.1.1 semver: 6.3.1 @@ -13108,7 +13109,7 @@ snapshots: node-fetch: 2.7.0 nopt: 8.1.0 semver: 7.7.4 - tar: 7.5.13 + tar: 7.5.19 transitivePeerDependencies: - encoding - supports-color @@ -16363,7 +16364,7 @@ snapshots: fs-extra: 10.1.0 gradient-string: 2.0.2 inquirer: 8.2.7(@types/node@22.20.0) - js-yaml: 4.1.0 + js-yaml: 4.3.1 ora: 4.1.1 picocolors: 1.0.1 semver: 7.6.2 @@ -16900,7 +16901,7 @@ snapshots: semver: 7.5.4 stat-mode: 0.3.0 stream-to-promise: 2.2.0 - tar: 7.5.7 + tar: 7.5.19 tinyexec: 0.3.2 tree-kill: 1.2.2 uid-promise: 1.0.0 @@ -17035,7 +17036,7 @@ snapshots: '@bytecodealliance/preview2-shim': 0.17.6 '@renovatebot/pep440': 4.2.1 fs-extra: 11.1.1 - js-yaml: 4.1.1 + js-yaml: 4.3.1 minimatch: 10.1.1 smol-toml: 1.5.2 zod: 3.22.4 @@ -17475,7 +17476,7 @@ snapshots: autoprefixer@10.4.21(postcss@8.5.6): dependencies: - browserslist: 4.25.4 + browserslist: 4.28.7 caniuse-lite: 1.0.30001739 fraction.js: 4.3.7 normalize-range: 0.1.2 @@ -17508,6 +17509,8 @@ snapshots: baseline-browser-mapping@2.10.30: {} + baseline-browser-mapping@2.11.21: {} + basic-ftp@5.0.5: {} before-after-hook@3.0.2: {} @@ -17575,12 +17578,12 @@ snapshots: bowser@2.12.1: {} - brace-expansion@1.1.12: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.0.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 @@ -17592,12 +17595,13 @@ snapshots: dependencies: fill-range: 7.1.1 - browserslist@4.25.4: + browserslist@4.28.7: dependencies: - caniuse-lite: 1.0.30001739 - electron-to-chromium: 1.5.214 - node-releases: 2.0.19 - update-browserslist-db: 1.1.3(browserslist@4.25.4) + baseline-browser-mapping: 2.11.21 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.422 + node-releases: 2.0.54 + update-browserslist-db: 1.3.2(browserslist@4.28.7) buffer-crc32@0.2.13: {} @@ -17662,6 +17666,8 @@ snapshots: caniuse-lite@1.0.30001739: {} + caniuse-lite@1.0.30001810: {} + canvas-size@1.2.6: {} capital-case@1.0.4: @@ -17970,7 +17976,7 @@ snapshots: cosmiconfig@8.3.6(typescript@5.5.4): dependencies: import-fresh: 3.3.1 - js-yaml: 4.1.0 + js-yaml: 4.3.1 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -17979,7 +17985,7 @@ snapshots: coveralls-next@4.2.2: dependencies: form-data: 4.0.4 - js-yaml: 4.1.0 + js-yaml: 4.3.1 lcov-parse: 1.0.0 log-driver: 1.2.7 minimist: 1.2.8 @@ -18466,7 +18472,7 @@ snapshots: ee-first@1.1.1: {} - electron-to-chromium@1.5.214: {} + electron-to-chromium@1.5.422: {} emoji-regex@10.6.0: {} @@ -20173,14 +20179,6 @@ snapshots: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.1.0: - dependencies: - argparse: 2.0.1 - - js-yaml@4.1.1: - dependencies: - argparse: 2.0.1 - js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -21056,23 +21054,23 @@ snapshots: minimatch@3.1.2: dependencies: - brace-expansion: 1.1.12 + brace-expansion: 1.1.18 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.12 + brace-expansion: 1.1.18 minimatch@5.1.6: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 2.1.4 minimatch@7.4.6: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 2.1.4 minimatch@9.0.5: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -21365,7 +21363,7 @@ snapshots: mkdirp: 0.5.6 resolve: 1.22.10 - node-releases@2.0.19: {} + node-releases@2.0.54: {} nopt@8.1.0: dependencies: @@ -23492,7 +23490,7 @@ snapshots: bin-links: 6.0.0 https-proxy-agent: 9.0.0 node-fetch: 3.3.2 - tar: 7.5.13 + tar: 7.5.19 transitivePeerDependencies: - supports-color @@ -23604,15 +23602,7 @@ snapshots: - bare-abort-controller - react-native-b4a - tar@7.5.13: - dependencies: - '@isaacs/fs-minipass': 4.0.1 - chownr: 3.0.0 - minipass: 7.1.2 - minizlib: 3.1.0 - yallist: 5.0.0 - - tar@7.5.7: + tar@7.5.19: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -24122,9 +24112,9 @@ snapshots: unpipe@1.0.0: {} - update-browserslist-db@1.1.3(browserslist@4.25.4): + update-browserslist-db@1.3.2(browserslist@4.28.7): dependencies: - browserslist: 4.25.4 + browserslist: 4.28.7 escalade: 3.2.0 picocolors: 1.1.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2a125d6ce..db719c741 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -60,6 +60,12 @@ onlyBuiltDependencies: - unrs-resolver overrides: + # Patched tooling dependencies for ENG-2236; preserve existing major versions. + "tar@>=7.0.0 <7.5.19": 7.5.19 + "browserslist@>=4.0.0 <4.28.7": 4.28.7 + "brace-expansion@>=1.0.0 <1.1.18": 1.1.18 + "brace-expansion@>=2.0.0 <2.1.4": 2.1.4 + "js-yaml@>=4.0.0 <4.3.1": 4.3.1 "@types/react-dom@18.2.17>@types/react": 18.2.21 "@types/react-vertical-timeline-component@3.3.6>@types/react": 18.2.21 react-charts@3.0.0-beta.57>@types/react: 18.2.21