From 8f338158a6ce4ccc2078a76232066751c70cf633 Mon Sep 17 00:00:00 2001 From: april418 Date: Tue, 21 Jul 2026 16:53:26 +0900 Subject: [PATCH] =?UTF-8?q?chore(deps):=202026-07=20audit=20=E6=B3=A2?= =?UTF-8?q?=E3=81=AE=E8=84=86=E5=BC=B1=E6=80=A7=20override=20=E3=82=92?= =?UTF-8?q?=E8=BF=BD=E5=8A=A0=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit brace-expansion / js-yaml / websocket-driver / shell-quote / axios に 対する新規 advisory 群 (GHSA-3jxr-9vmj-r5cp ほか critical 1 件・ high 4 件) の公開により pnpm audit が失敗していた。本リポジトリで 検出された advisory に対応する override を pnpm-workspace.yaml に 追加し、lockfile を再生成して audit 0 件を確認した。 brace-expansion の 3.x-5.0.6 は patch が出ておらず 5.0.7 が必要。 5.0.x は lockfile の既存解決が range を満たし自然には上がらないため override で強制している。 Co-Authored-By: Claude Fable 5 --- pnpm-lock.yaml | 58 +++++++++++++++++++++++++-------------------- pnpm-workspace.yaml | 6 +++++ 2 files changed, 38 insertions(+), 26 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 61a08b3..1f1e4be 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,6 +10,11 @@ overrides: esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' + websocket-driver: '>=0.7.5' + brace-expansion@1: '>=1.1.16 <2' + js-yaml@4: '>=4.3.0' + shell-quote: '>=1.9.0' + brace-expansion@>=3 <5.0.7: '>=5.0.7' importers: @@ -837,11 +842,11 @@ packages: bonjour-service@1.3.0: resolution: {integrity: sha512-3YuAUiSkWykd+2Azjgyxei8OWf8thdn8AITIog2M4UICzoqfjlqr64WIjEXZllf/W6vK1goqleSR6brGomxQqA==} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -1656,8 +1661,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} + js-yaml@5.2.1: + resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==} hasBin: true jsdom@25.0.1: @@ -2258,8 +2263,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.4: - resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} + shell-quote@1.10.0: + resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==} engines: {node: '>= 0.4'} side-channel-list@1.0.0: @@ -2562,6 +2567,7 @@ packages: uuid@8.3.2: resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true validate-npm-package-license@3.0.4: @@ -2724,8 +2730,8 @@ packages: webpack-cli: optional: true - websocket-driver@0.7.4: - resolution: {integrity: sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==} + websocket-driver@0.7.5: + resolution: {integrity: sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==} engines: {node: '>=0.8.0'} websocket-extensions@0.1.4: @@ -2921,7 +2927,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 5.2.1 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -3367,7 +3373,7 @@ snapshots: dependencies: '@types/node': 25.5.0 - '@typescript-eslint/eslint-plugin@8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2)': + '@typescript-eslint/eslint-plugin@8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2)': dependencies: '@eslint-community/regexpp': 4.12.2 '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) @@ -3704,12 +3710,12 @@ snapshots: fast-deep-equal: 3.1.3 multicast-dns: 7.2.5 - brace-expansion@1.1.14: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.5: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -3985,7 +3991,7 @@ snapshots: transitivePeerDependencies: - typescript - eslint-plugin-prettier@5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@10.1.8(eslint@10.1.0))(eslint@9.39.4)(prettier@3.8.1): + eslint-plugin-prettier@5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@10.1.8(eslint@9.39.4))(eslint@9.39.4)(prettier@3.8.1): dependencies: eslint: 9.39.4 prettier: 3.8.1 @@ -4198,7 +4204,7 @@ snapshots: faye-websocket@0.11.4: dependencies: - websocket-driver: 0.7.4 + websocket-driver: 0.7.5 fdir@6.5.0(picomatch@4.0.4): optionalDependencies: @@ -4317,13 +4323,13 @@ snapshots: gts@7.0.0(@types/eslint@9.6.1)(typescript@6.0.2): dependencies: '@eslint/js': 9.39.4 - '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) + '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) chalk: 4.1.2 eslint: 9.39.4 eslint-config-prettier: 10.1.8(eslint@9.39.4) eslint-plugin-n: 17.24.0(eslint@9.39.4)(typescript@6.0.2) - eslint-plugin-prettier: 5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@10.1.8(eslint@10.1.0))(eslint@9.39.4)(prettier@3.8.1) + eslint-plugin-prettier: 5.5.5(@types/eslint@9.6.1)(eslint-config-prettier@10.1.8(eslint@9.39.4))(eslint@9.39.4)(prettier@3.8.1) execa: 5.1.1 inquirer: 7.3.3 json5: 2.2.3 @@ -4558,7 +4564,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.1.1: + js-yaml@5.2.1: dependencies: argparse: 2.0.1 @@ -4611,7 +4617,7 @@ snapshots: launch-editor@2.13.2: dependencies: picocolors: 1.1.1 - shell-quote: 1.8.4 + shell-quote: 1.10.0 levn@0.4.1: dependencies: @@ -4776,11 +4782,11 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.7 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.16 minimist-options@4.1.0: dependencies: @@ -5164,7 +5170,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.4: {} + shell-quote@1.10.0: {} side-channel-list@1.0.0: dependencies: @@ -5204,7 +5210,7 @@ snapshots: dependencies: faye-websocket: 0.11.4 uuid: 8.3.2 - websocket-driver: 0.7.4 + websocket-driver: 0.7.5 source-map-js@1.2.1: {} @@ -5412,7 +5418,7 @@ snapshots: typescript-eslint@8.57.2(eslint@9.39.4)(typescript@6.0.2): dependencies: - '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@10.1.0)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) + '@typescript-eslint/eslint-plugin': 8.57.2(@typescript-eslint/parser@8.57.2(eslint@9.39.4)(typescript@6.0.2))(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/parser': 8.57.2(eslint@9.39.4)(typescript@6.0.2) '@typescript-eslint/typescript-estree': 8.57.2(typescript@6.0.2) '@typescript-eslint/utils': 8.57.2(eslint@9.39.4)(typescript@6.0.2) @@ -5616,7 +5622,7 @@ snapshots: - esbuild - uglify-js - websocket-driver@0.7.4: + websocket-driver@0.7.5: dependencies: http-parser-js: 0.5.10 safe-buffer: 5.2.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 424653b..279a30d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -13,6 +13,12 @@ overrides: esbuild@<0.28.1: '>=0.28.1 <1.0.0' ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' + # 2026-07 audit 波の新規 advisory 対応 + 'websocket-driver': '>=0.7.5' + 'brace-expansion@1': '>=1.1.16 <2' + 'js-yaml@4': '>=4.3.0' + 'shell-quote': '>=1.9.0' + 'brace-expansion@>=3 <5.0.7': '>=5.0.7' packageManagerStrictVersion: true savePrefix: "" trustPolicy: no-downgrade