From 9e8722dc9fb68a4ee3e382ac681790f1d3362eec Mon Sep 17 00:00:00 2001 From: chengcheng Date: Tue, 28 Jul 2026 04:04:55 +0800 Subject: [PATCH] =?UTF-8?q?fix(deps):=20=E4=BF=AE=E5=A4=8D=20Gateway=20?= =?UTF-8?q?=E4=BE=9D=E8=B5=96=E6=8B=92=E7=BB=9D=E6=9C=8D=E5=8A=A1=E9=A3=8E?= =?UTF-8?q?=E9=99=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 将 Nx 间接使用的 minimatch 收敛到 10.2.6，从而使用带长度上限的 brace-expansion 5.0.8；同时升级 DOMPurify 到 3.4.12。\n\n变更保留 Node 22 运行基线，并通过 filelist 兼容检查、Gateway 全量 Go 与 Web 测试、构建、OpenAPI、迁移、发布脚本、govulncheck 和 pnpm audit。审计结果为 0 个已知漏洞。 --- pnpm-lock.yaml | 57 ++++++++++++++------------------------------- pnpm-workspace.yaml | 5 ++-- 2 files changed, 20 insertions(+), 42 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ed3accd..f0acd0c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,14 +7,13 @@ settings: overrides: '@babel/core@<=7.29.0': 7.29.6 axios@<1.18.0: 1.18.0 - brace-expansion@>=2.0.0 <2.1.2: 2.1.2 - dompurify@<=3.4.10: 3.4.11 + dompurify@<=3.4.11: 3.4.12 esbuild@>=0.27.3 <0.28.1: 0.28.1 fast-uri@>=3.0.0 <3.1.4: 3.1.4 form-data@>=4.0.0 <4.0.6: 4.0.6 js-yaml@<4.3.0: 4.3.0 mermaid@>=11.0.0-alpha.1 <=11.14.0: 11.15.0 - minimatch@>=9.0.0 <9.0.7: 9.0.7 + minimatch@>=5.0.0 <10.2.6: 10.2.6 '@nx/js>picomatch': 4.0.5 '@nx/vite>picomatch': 4.0.5 '@nx/workspace>picomatch': 4.0.5 @@ -2542,9 +2541,6 @@ packages: bail@2.0.2: resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -2560,12 +2556,9 @@ packages: bl@4.1.0: resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} browserslist@4.28.2: resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} @@ -2912,8 +2905,8 @@ packages: devlop@1.1.0: resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==} - dompurify@3.4.11: - resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==} + dompurify@3.4.12: + resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==} dotenv-cli@11.0.0: resolution: {integrity: sha512-r5pA8idbk7GFWuHEU7trSTflWcdBpQEK+Aw17UrSHjS6CReuhrrPcyC3zcQBPQvhArRHnBo/h6eLH1fkCvNlww==} @@ -3634,13 +3627,9 @@ packages: resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} engines: {node: '>=6'} - minimatch@5.1.9: - resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==} - engines: {node: '>=10'} - - minimatch@9.0.7: - resolution: {integrity: sha512-MOwgjc8tfrpn5QQEvjijjmDVtMw2oL88ugTevzxQnzRLm6l3fVEF2gzU0kYeYYKD8C66+IdGX6peJ4MyUlUnPg==} - engines: {node: '>=16 || 14 >=14.17'} + minimatch@10.2.6: + resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} + engines: {node: 18 || 20 || >=22} minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -5718,7 +5707,7 @@ snapshots: ejs: 3.1.10 enquirer: 2.3.6 ignore: 5.3.2 - minimatch: 9.0.7 + minimatch: 10.2.6 nx: 21.6.11 semver: 7.8.0 tslib: 2.8.1 @@ -7342,8 +7331,6 @@ snapshots: bail@2.0.2: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} base64-js@1.5.1: {} @@ -7356,11 +7343,7 @@ snapshots: inherits: 2.0.4 readable-stream: 3.6.2 - brace-expansion@2.1.2: - dependencies: - balanced-match: 1.0.2 - - brace-expansion@5.0.7: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -7721,7 +7704,7 @@ snapshots: dependencies: dequal: 2.0.3 - dompurify@3.4.11: + dompurify@3.4.12: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -7867,7 +7850,7 @@ snapshots: filelist@1.0.6: dependencies: - minimatch: 5.1.9 + minimatch: 10.2.6 flat@5.0.2: {} @@ -8451,7 +8434,7 @@ snapshots: d3-sankey: 0.12.3 dagre-d3-es: 7.0.14 dayjs: 1.11.20 - dompurify: 3.4.11 + dompurify: 3.4.12 es-toolkit: 1.49.0 katex: 0.16.45 khroma: 2.1.0 @@ -8702,13 +8685,9 @@ snapshots: mimic-fn@2.1.0: {} - minimatch@5.1.9: + minimatch@10.2.6: dependencies: - brace-expansion: 2.1.2 - - minimatch@9.0.7: - dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.8 minimist@1.2.8: {} @@ -8754,7 +8733,7 @@ snapshots: jest-diff: 30.4.1 jsonc-parser: 3.2.0 lines-and-columns: 2.0.3 - minimatch: 9.0.7 + minimatch: 10.2.6 node-machine-id: 1.1.12 npm-run-path: 4.0.1 open: 8.4.2 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3238170..a211141 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,14 +9,13 @@ allowBuilds: overrides: '@babel/core@<=7.29.0': 7.29.6 'axios@<1.18.0': 1.18.0 - 'brace-expansion@>=2.0.0 <2.1.2': 2.1.2 - 'dompurify@<=3.4.10': 3.4.11 + 'dompurify@<=3.4.11': 3.4.12 'esbuild@>=0.27.3 <0.28.1': 0.28.1 'fast-uri@>=3.0.0 <3.1.4': 3.1.4 'form-data@>=4.0.0 <4.0.6': 4.0.6 'js-yaml@<4.3.0': 4.3.0 'mermaid@>=11.0.0-alpha.1 <=11.14.0': 11.15.0 - 'minimatch@>=9.0.0 <9.0.7': 9.0.7 + 'minimatch@>=5.0.0 <10.2.6': 10.2.6 '@nx/js>picomatch': 4.0.5 '@nx/vite>picomatch': 4.0.5 '@nx/workspace>picomatch': 4.0.5