From 97b229a4487c700cd772698808b678be2133caa0 Mon Sep 17 00:00:00 2001 From: april418 Date: Mon, 27 Jul 2026 16:54:49 +0900 Subject: [PATCH] =?UTF-8?q?fix(deps):=202026-07-27=20audit=20=E6=B3=A2?= =?UTF-8?q?=E3=81=AE=20high=20=E8=84=86=E5=BC=B1=E6=80=A7=E3=82=92?= =?UTF-8?q?=E8=A7=A3=E6=B6=88=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit brace-expansion / js-yaml / postcss / fast-uri で新しい advisory が 公開され、いずれも既存 override をすり抜けて high 検出されていた。 すり抜けの原因は 2 つある。 1. セレクタの上限が固定値だった brace-expansion の既存 override は `>=3 <5.0.7` を `>=5.0.7` へ 寄せる形で、5.0.7 自身が脆弱化した今回はセレクタにマッチしない。 上限を 5.0.8 へ引き上げた。 2. override セレクタは解決後の版ではなく親が宣言するレンジにマッチする js-yaml は eslint 系が `^4` で宣言し、既存 override `js-yaml@4: ">=4.3.0"` が上限なしのため実際には 5 系が入っていた。 `js-yaml@5` のセレクタを足しても宣言レンジと交差せず発火しないため、 既存 override の下限を 5.2.2 へ引き上げる形で修正した。 また brace-expansion は 5.0.7 以下が全て脆弱になり 1 系 / 2 系に安全版が 無くなった。これらを要求するのは minimatch の旧メジャーなので、minimatch を brace-expansion 5 系を使う 10 系へ引き上げて解消している。 brace-expansion 5.0.8 と js-yaml 5.2.2 は 2026-07-23 公開で minimumReleaseAge (7日) を満たさないため exclude に追加した。 2026-07-31 以降に削除すること。 Co-Authored-By: Claude Opus 5 (1M context) --- pnpm-lock.yaml | 75 ++++++++++++++++----------------------------- pnpm-workspace.yaml | 15 +++++++-- 2 files changed, 39 insertions(+), 51 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c0660b0..9a231de 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,9 +9,13 @@ overrides: esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' - brace-expansion@1: '>=1.1.16 <2' - js-yaml@4: '>=4.3.0' - brace-expansion@>=3 <5.0.7: '>=5.0.7' + brace-expansion@1: '>=5.0.8' + js-yaml@4: '>=5.2.2' + brace-expansion@>=3 <5.0.8: '>=5.0.8' + brace-expansion@2: '>=5.0.8' + minimatch@<10.0.0: '>=10.2.4' + postcss@<8.5.18: '>=8.5.18' + fast-uri@>=3.0.0 <3.1.4: '>=3.1.4' importers: @@ -496,19 +500,13 @@ packages: asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - brace-expansion@1.1.16: - resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} call-bind-apply-helpers@1.0.2: resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==} @@ -556,9 +554,6 @@ packages: resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==} engines: {node: '>= 0.8'} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - content-disposition@1.0.1: resolution: {integrity: sha512-oIXISMynqSqm241k6kcQ5UwttDILMK4BiurCfGEREw6+X9jkkpEe5T9FZaApyLGGOnFuyMWZpdolTXMtvEJ08Q==} engines: {node: '>=18'} @@ -1074,8 +1069,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@5.2.1: - resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==} + js-yaml@5.2.2: + resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==} hasBin: true jsdom@25.0.1: @@ -1293,9 +1288,6 @@ packages: resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimist-options@4.1.0: resolution: {integrity: sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==} engines: {node: '>= 6'} @@ -1306,8 +1298,8 @@ packages: mute-stream@0.0.8: resolution: {integrity: sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1414,8 +1406,8 @@ packages: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.20: + resolution: {integrity: sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -1950,7 +1942,7 @@ snapshots: dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3 - minimatch: 3.1.5 + minimatch: 10.2.4 transitivePeerDependencies: - supports-color @@ -1986,8 +1978,8 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 5.2.1 - minimatch: 3.1.5 + js-yaml: 5.2.2 + minimatch: 10.2.4 strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -2318,16 +2310,9 @@ snapshots: asynckit@0.4.0: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} - brace-expansion@1.1.16: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@5.0.7: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -2371,8 +2356,6 @@ snapshots: dependencies: delayed-stream: 1.0.0 - concat-map@0.0.1: {} - content-disposition@1.0.1: {} content-type@1.0.5: {} @@ -2605,7 +2588,7 @@ snapshots: is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 lodash.merge: 4.6.2 - minimatch: 3.1.5 + minimatch: 10.2.4 natural-compare: 1.4.0 optionator: 0.9.4 transitivePeerDependencies: @@ -2927,7 +2910,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@5.2.1: + js-yaml@5.2.2: dependencies: argparse: 2.0.1 @@ -3148,11 +3131,7 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.7 - - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.16 + brace-expansion: 5.0.8 minimist-options@4.1.0: dependencies: @@ -3164,7 +3143,7 @@ snapshots: mute-stream@0.0.8: {} - nanoid@3.3.12: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -3262,9 +3241,9 @@ snapshots: picomatch@4.0.4: {} - postcss@8.5.15: + postcss@8.5.20: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3528,7 +3507,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.20 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 982203e..ba333ae 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,15 +7,24 @@ minimumReleaseAgeExclude: - '@esbuild/*' - form-data - tmp + # brace-expansion 5.0.8 / js-yaml 5.2.2 (いずれも 2026-07-23 公開) が + # minimumReleaseAge (7日) を超えたら削除すること -> 2026-07-31 以降 + - brace-expansion + - js-yaml overrides: tmp@<0.2.7: '>=0.2.7 <1.0.0' esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' # 2026-07 audit 波の新規 advisory 対応 - 'brace-expansion@1': '>=1.1.16 <2' - 'js-yaml@4': '>=4.3.0' - 'brace-expansion@>=3 <5.0.7': '>=5.0.7' + 'brace-expansion@1': '>=5.0.8' + 'js-yaml@4': '>=5.2.2' + 'brace-expansion@>=3 <5.0.8': '>=5.0.8' + # 2026-07-27 audit 波の新規 advisory 対応 + 'brace-expansion@2': '>=5.0.8' + 'minimatch@<10.0.0': '>=10.2.4' + 'postcss@<8.5.18': '>=8.5.18' + 'fast-uri@>=3.0.0 <3.1.4': '>=3.1.4' packageManagerStrictVersion: true savePrefix: "" trustPolicy: no-downgrade