From 8f3a2e3b8a3287f59d1b000fa3c1ea5f94f31d89 Mon Sep 17 00:00:00 2001 From: Guide Date: Sat, 19 Sep 2026 14:29:04 +0800 Subject: [PATCH] fix(deps): patch dependency security vulnerabilities --- package.json | 9 +++-- pnpm-lock.yaml | 95 +++++++++++++++++++++++++++----------------------- 2 files changed, 58 insertions(+), 46 deletions(-) diff --git a/package.json b/package.json index c6001a895a8..0157e5e846c 100644 --- a/package.json +++ b/package.json @@ -10,12 +10,15 @@ "vite": "8.0.16", "undici": "7.29.0", "mdast-util-to-hast": ">=13.2.1", - "js-yaml@>=3.0.0 <3.15.1": "3.15.1", - "js-yaml@>=4.0.0 <4.3.1": "4.3.1", + "js-yaml@>=3.0.0 <3.15.2": "3.15.2", + "js-yaml@>=4.0.0 <4.3.2": "4.3.2", "rollup": ">=4.59.0", "dompurify": ">=3.3.2", "lodash-es": ">=4.18.0", - "@xmldom/xmldom": ">=0.9.10", + "@xmldom/xmldom": "0.9.12", + "browserslist@<4.28.7": "4.28.7", + "baseline-browser-mapping@<2.11.0": "2.11.0", + "fflate@<0.8.3": "0.8.3", "picomatch": ">=4.0.4", "immutable": "5.1.8", "linkify-it": "5.0.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f4f809947dd..13eb427ac6b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,12 +8,15 @@ overrides: vite: 8.0.16 undici: 7.29.0 mdast-util-to-hast: '>=13.2.1' - js-yaml@>=3.0.0 <3.15.1: 3.15.1 - js-yaml@>=4.0.0 <4.3.1: 4.3.1 + js-yaml@>=3.0.0 <3.15.2: 3.15.2 + js-yaml@>=4.0.0 <4.3.2: 4.3.2 rollup: '>=4.59.0' dompurify: '>=3.3.2' lodash-es: '>=4.18.0' - '@xmldom/xmldom': '>=0.9.10' + '@xmldom/xmldom': 0.9.12 + browserslist@<4.28.7: 4.28.7 + baseline-browser-mapping@<2.11.0: 2.11.0 + fflate@<0.8.3: 0.8.3 picomatch: '>=4.0.4' immutable: 5.1.8 linkify-it: 5.0.2 @@ -1431,10 +1434,9 @@ packages: peerDependencies: vue: ^3.5.0 - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} - deprecated: this version has critical issues, please update to the latest version acorn@8.15.0: resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==} @@ -1483,8 +1485,9 @@ packages: balloon-css@1.2.0: resolution: {integrity: sha512-urXwkHgwp6GsXVF+it01485Z2Cj4pnW02ICnM0TemOlkKmCNnDLmyy+ZZiRXBpwldUXO+aRNr7Hdia4CBvXJ5A==} - baseline-browser-mapping@2.9.14: - resolution: {integrity: sha512-B0xUquLkiGLgHhpPBqvl7GWegWBUNuujQ6kXd/r1U38ElPT6Ok8KZ8e+FpUGEc2ZoRQUzq/aUnaKFc/svWUGSg==} + baseline-browser-mapping@2.11.0: + resolution: {integrity: sha512-oCu2wfipvX3AePSgmOuKkIywOu+8n9psz7hXYmk56ghpu3+7KzNIBopaOs4c9BrtdnTtW30unG9GTfHo7EwERQ==} + engines: {node: '>=6.0.0'} hasBin: true bcrypt-ts@8.0.1: @@ -1501,8 +1504,8 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - browserslist@4.28.1: - resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==} + browserslist@4.28.7: + resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -1517,6 +1520,9 @@ packages: caniuse-lite@1.0.30001786: resolution: {integrity: sha512-4oxTZEvqmLLrERwxO76yfKM7acZo310U+v4kqexI2TL1DkkUEMT8UijrxxcnVdxR3qkVf5awGRX+4Z6aPHVKrA==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} + ccount@2.0.1: resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==} @@ -1829,8 +1835,8 @@ packages: domutils@3.2.2: resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==} - electron-to-chromium@1.5.267: - resolution: {integrity: sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==} + electron-to-chromium@1.5.433: + resolution: {integrity: sha512-5lCAbyZBjtmUt/RAGHRqrL2q0oEFRThDAsZHHDn9XHa89Qw7gMYOeSicBTy+AHfvo0r6vwsZvqNJTQIQy1BLzA==} emoji-regex@8.0.0: resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==} @@ -1905,8 +1911,8 @@ packages: picomatch: optional: true - fflate@0.8.2: - resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==} + fflate@0.8.3: + resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==} fill-range@7.1.1: resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==} @@ -2064,12 +2070,12 @@ packages: resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==} engines: {node: '>=18'} - js-yaml@3.15.1: - resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsesc@3.1.0: @@ -2391,8 +2397,9 @@ packages: node-addon-api@7.1.1: resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==} - node-releases@2.0.27: - resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==} + node-releases@2.0.56: + resolution: {integrity: sha512-x0InOIyzgdk+eyaWaRJFH5snEtiImgBgblZ2CyPrLmqqcuMQkEvcDPHbzqbD8eDsSeJbVOjn+crzyzHaM4D+/A==} + engines: {node: '>=18'} nth-check@2.1.1: resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==} @@ -2891,7 +2898,7 @@ packages: resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: 4.28.7 uuid@14.0.1: resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==} @@ -4182,7 +4189,7 @@ snapshots: '@vue/shared': 3.5.32 '@vueuse/core': 14.2.1(vue@3.5.32) cheerio: 1.2.0 - fflate: 0.8.2 + fflate: 0.8.3 gray-matter: 4.0.3 vue: 3.5.32 vuepress: 2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32) @@ -4376,7 +4383,7 @@ snapshots: '@mdit/plugin-tasklist': 0.23.2(markdown-it@14.2.0) '@types/markdown-it': 14.1.2 '@vuepress/helper': 2.0.0-rc.128(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vuepress@2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32)) - js-yaml: 4.3.1 + js-yaml: 4.3.2 markdown-it-cjk-friendly: 2.0.2(@types/markdown-it@14.1.2)(markdown-it@14.2.0) vuepress: 2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32) transitivePeerDependencies: @@ -4649,7 +4656,7 @@ snapshots: dependencies: vue: 3.5.32 - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} acorn@8.15.0: {} @@ -4681,7 +4688,7 @@ snapshots: autoprefixer@10.4.27(postcss@8.5.23): dependencies: - browserslist: 4.28.1 + browserslist: 4.28.7 caniuse-lite: 1.0.30001786 fraction.js: 5.3.4 picocolors: 1.1.1 @@ -4692,7 +4699,7 @@ snapshots: balloon-css@1.2.0: {} - baseline-browser-mapping@2.9.14: {} + baseline-browser-mapping@2.11.0: {} bcrypt-ts@8.0.1: {} @@ -4704,13 +4711,13 @@ snapshots: dependencies: fill-range: 7.1.1 - browserslist@4.28.1: + browserslist@4.28.7: dependencies: - baseline-browser-mapping: 2.9.14 - caniuse-lite: 1.0.30001786 - electron-to-chromium: 1.5.267 - node-releases: 2.0.27 - update-browserslist-db: 1.2.3(browserslist@4.28.1) + baseline-browser-mapping: 2.11.0 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.433 + node-releases: 2.0.56 + update-browserslist-db: 1.2.3(browserslist@4.28.7) cac@7.0.0: {} @@ -4718,6 +4725,8 @@ snapshots: caniuse-lite@1.0.30001786: {} + caniuse-lite@1.0.30001810: {} + ccount@2.0.1: {} chalk@5.6.2: {} @@ -5052,7 +5061,7 @@ snapshots: domelementtype: 2.3.0 domhandler: 5.0.3 - electron-to-chromium@1.5.267: {} + electron-to-chromium@1.5.433: {} emoji-regex@8.0.0: {} @@ -5132,7 +5141,7 @@ snapshots: optionalDependencies: picomatch: 4.0.4 - fflate@0.8.2: {} + fflate@0.8.3: {} fill-range@7.1.1: dependencies: @@ -5179,7 +5188,7 @@ snapshots: gray-matter@4.0.3: dependencies: - js-yaml: 3.15.1 + js-yaml: 3.15.2 kind-of: 6.0.3 section-matter: 1.0.0 strip-bom-string: 1.0.0 @@ -5302,12 +5311,12 @@ snapshots: is-unicode-supported@2.1.0: {} - js-yaml@3.15.1: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -5461,7 +5470,7 @@ snapshots: markdownlint-cli2@0.17.1: dependencies: globby: 14.0.2 - js-yaml: 4.3.1 + js-yaml: 4.3.2 jsonc-parser: 3.3.1 markdownlint: 0.37.3 markdownlint-cli2-formatter-default: 0.0.5(markdownlint-cli2@0.17.1) @@ -5739,7 +5748,7 @@ snapshots: node-addon-api@7.1.1: optional: true - node-releases@2.0.27: {} + node-releases@2.0.56: {} nth-check@2.1.1: dependencies: @@ -6112,7 +6121,7 @@ snapshots: speech-rule-engine@4.1.2: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 commander: 13.1.0 wicked-good-xpath: 1.3.0 @@ -6246,9 +6255,9 @@ snapshots: upath@2.0.1: {} - update-browserslist-db@1.2.3(browserslist@4.28.1): + update-browserslist-db@1.2.3(browserslist@4.28.7): dependencies: - browserslist: 4.28.1 + browserslist: 4.28.7 escalade: 3.2.0 picocolors: 1.1.1 @@ -6346,7 +6355,7 @@ snapshots: '@vuepress/plugin-sass-palette': 2.0.0-rc.128(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(sass-embedded@1.99.0)(sass@1.99.0)(vuepress@2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32)) '@vueuse/core': 14.2.1(vue@3.5.32) balloon-css: 1.2.0 - js-yaml: 4.3.1 + js-yaml: 4.3.2 vue: 3.5.32 vuepress: 2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32) vuepress-shared: 2.0.0-rc.106(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vuepress@2.0.0-rc.28(@vue/compiler-sfc@3.5.32)(@vuepress/bundler-vite@2.0.0-rc.28(@types/node@25.0.9)(@vue/compiler-sfc@3.5.32)(esbuild@0.28.1)(sass-embedded@1.99.0)(sass@1.99.0)(yaml@2.8.3))(vue@3.5.32))