From 257ee09e589f56bb66b2de8d6cd43ccee393e26e Mon Sep 17 00:00:00 2001 From: chengcheng Date: Tue, 21 Jul 2026 09:57:02 +0800 Subject: [PATCH] =?UTF-8?q?build(deps):=20=E4=BF=AE=E5=A4=8D=E6=9E=84?= =?UTF-8?q?=E5=BB=BA=E9=93=BE=E9=AB=98=E5=8D=B1=E4=BE=9D=E8=B5=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pnpm audit 新增报告 Nx 构建链中的 axios、brace-expansion 和 js-yaml 高危漏洞。通过最小 overrides 将其固定到已修复版本，并同步锁文件。\n\n影响：仅调整开发与构建依赖解析，不改变生产运行时计费逻辑。\n\n验证：pnpm install --frozen-lockfile、pnpm audit --audit-level high、pnpm lint、pnpm test、pnpm build 及仓库完整 CI 门禁均已通过。 --- pnpm-lock.yaml | 65 ++++++++++++++++++++++++++++++++------------- pnpm-workspace.yaml | 4 ++- 2 files changed, 49 insertions(+), 20 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0918eae..524987d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,15 +6,17 @@ settings: overrides: '@babel/core@<=7.29.0': 7.29.6 - dompurify@<=3.4.10: 3.4.11 - esbuild@>=0.27.3 <0.28.1: 0.28.1 - form-data@>=4.0.0 <4.0.6: 4.0.6 - js-yaml@<3.15.0: 4.1.1 - mermaid@>=11.0.0-alpha.1 <=11.14.0: 11.15.0 - minimatch@>=9.0.0 <9.0.7: 9.0.7 '@nx/js>picomatch': 4.0.5 '@nx/vite>picomatch': 4.0.5 '@nx/workspace>picomatch': 4.0.5 + axios@<1.18.0: 1.18.0 + brace-expansion@>=2.0.0 <2.1.2: 2.1.2 + dompurify@<=3.4.10: 3.4.11 + esbuild@>=0.27.3 <0.28.1: 0.28.1 + form-data@>=4.0.0 <4.0.6: 4.0.6 + js-yaml@<4.3.0: 4.3.0 + mermaid@>=11.0.0-alpha.1 <=11.14.0: 11.15.0 + minimatch@>=9.0.0 <9.0.7: 9.0.7 tmp@<0.2.7: 0.2.7 importers: @@ -2443,6 +2445,10 @@ packages: resolution: {integrity: sha512-4B/qKCfeE/ODUaAUpSwfzazo5x29WD4r3vXiWsB7I2mSDAihwEqKO+g8GELZUQSSAo5e1XTYh3ZVfLyxBc12nA==} engines: {node: '>= 10.0.0'} + agent-base@6.0.2: + resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==} + engines: {node: '>= 6.0.0'} + ajv@8.20.0: resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==} @@ -2491,8 +2497,8 @@ packages: asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - axios@1.16.0: - resolution: {integrity: sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==} + axios@1.18.0: + resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==} babel-plugin-const-enum@1.2.0: resolution: {integrity: sha512-o1m/6iyyFnp9MRsK1dHF3bneqyf3AlM2q3A/YbgQr2pCat6B6XJVDv2TXqzfY2RYUi4mak6WAksSBPlyYGx9dg==} @@ -2553,8 +2559,8 @@ packages: bl@4.1.0: resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==} - brace-expansion@2.1.0: - resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} + brace-expansion@2.1.2: + resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} brace-expansion@5.0.7: resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} @@ -3184,6 +3190,10 @@ packages: html-void-elements@3.0.0: resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==} + https-proxy-agent@5.0.1: + resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==} + engines: {node: '>= 6'} + iconv-lite@0.6.3: resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==} engines: {node: '>=0.10.0'} @@ -3281,8 +3291,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsesc@3.1.0: @@ -5820,6 +5830,7 @@ snapshots: - '@swc-node/register' - '@swc/core' - debug + - supports-color '@phenomnomnominal/tsquery@5.0.1(typescript@5.9.3)': dependencies: @@ -7152,7 +7163,7 @@ snapshots: '@yarnpkg/parsers@3.0.2': dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.0 tslib: 2.8.1 '@zkochan/js-yaml@0.0.7': @@ -7161,6 +7172,12 @@ snapshots: address@1.2.2: {} + agent-base@6.0.2: + dependencies: + debug: 4.4.3 + transitivePeerDependencies: + - supports-color + ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 @@ -7258,13 +7275,15 @@ snapshots: asynckit@0.4.0: {} - axios@1.16.0: + axios@1.18.0: dependencies: follow-redirects: 1.16.0 form-data: 4.0.6 + https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: - debug + - supports-color babel-plugin-const-enum@1.2.0(@babel/core@7.29.6): dependencies: @@ -7336,7 +7355,7 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - brace-expansion@2.1.0: + brace-expansion@2.1.2: dependencies: balanced-match: 1.0.2 @@ -7863,7 +7882,7 @@ snapshots: front-matter@4.0.2: dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.0 fs-constants@1.0.0: {} @@ -8054,6 +8073,13 @@ snapshots: html-void-elements@3.0.0: {} + https-proxy-agent@5.0.1: + dependencies: + agent-base: 6.0.2 + debug: 4.4.3 + transitivePeerDependencies: + - supports-color + iconv-lite@0.6.3: dependencies: safer-buffer: 2.1.2 @@ -8129,7 +8155,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.1.1: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -8677,7 +8703,7 @@ snapshots: minimatch@5.1.9: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.2 minimatch@9.0.7: dependencies: @@ -8712,7 +8738,7 @@ snapshots: '@yarnpkg/lockfile': 1.1.0 '@yarnpkg/parsers': 3.0.2 '@zkochan/js-yaml': 0.0.7 - axios: 1.16.0 + axios: 1.18.0 chalk: 4.1.2 cli-cursor: 3.1.0 cli-spinners: 2.6.1 @@ -8756,6 +8782,7 @@ snapshots: '@nx/nx-win32-x64-msvc': 21.6.11 transitivePeerDependencies: - debug + - supports-color once@1.4.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fea2db6..012fa01 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -8,10 +8,12 @@ allowBuilds: overrides: '@babel/core@<=7.29.0': 7.29.6 + 'axios@<1.18.0': 1.18.0 + 'brace-expansion@>=2.0.0 <2.1.2': 2.1.2 'dompurify@<=3.4.10': 3.4.11 'esbuild@>=0.27.3 <0.28.1': 0.28.1 'form-data@>=4.0.0 <4.0.6': 4.0.6 - 'js-yaml@<3.15.0': 4.1.1 + 'js-yaml@<4.3.0': 4.3.0 'mermaid@>=11.0.0-alpha.1 <=11.14.0': 11.15.0 'minimatch@>=9.0.0 <9.0.7': 9.0.7 '@nx/js>picomatch': 4.0.5