fix(deps): 修复 Gateway 依赖拒绝服务风险

将 Nx 间接使用的 minimatch 收敛到 10.2.6，从而使用带长度上限的 brace-expansion 5.0.8；同时升级 DOMPurify 到 3.4.12。\n\n变更保留 Node 22 运行基线，并通过 filelist 兼容检查、Gateway 全量 Go 与 Web 测试、构建、OpenAPI、迁移、发布脚本、govulncheck 和 pnpm audit。审计结果为 0 个已知漏洞。

pnpm-lock.yaml

@@ -7,14 +7,13 @@ settings:
 overrides:
   '@babel/core@<=7.29.0': 7.29.6
   axios@<1.18.0: 1.18.0
-  brace-expansion@>=2.0.0 <2.1.2: 2.1.2
+  dompurify@<=3.4.11: 3.4.12
-  dompurify@<=3.4.10: 3.4.11
   esbuild@>=0.27.3 <0.28.1: 0.28.1
   fast-uri@>=3.0.0 <3.1.4: 3.1.4
   form-data@>=4.0.0 <4.0.6: 4.0.6
   js-yaml@<4.3.0: 4.3.0
   mermaid@>=11.0.0-alpha.1 <=11.14.0: 11.15.0
-  minimatch@>=9.0.0 <9.0.7: 9.0.7
+  minimatch@>=5.0.0 <10.2.6: 10.2.6
   '@nx/js>picomatch': 4.0.5
   '@nx/vite>picomatch': 4.0.5
   '@nx/workspace>picomatch': 4.0.5
@@ -2542,9 +2541,6 @@ packages:
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
 
-  balanced-match@1.0.2:
-    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
-
   balanced-match@4.0.4:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
@@ -2560,12 +2556,9 @@ packages:
   bl@4.1.0:
     resolution: {integrity: sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
 
-  brace-expansion@2.1.2:
+  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
+    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
-
+    engines: {node: 20 || >=22}
-  brace-expansion@5.0.7:
-    resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
-    engines: {node: 18 || 20 || >=22}
 
   browserslist@4.28.2:
     resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
@@ -2912,8 +2905,8 @@ packages:
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
 
-  dompurify@3.4.11:
+  dompurify@3.4.12:
-    resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==}
+    resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==}
 
   dotenv-cli@11.0.0:
     resolution: {integrity: sha512-r5pA8idbk7GFWuHEU7trSTflWcdBpQEK+Aw17UrSHjS6CReuhrrPcyC3zcQBPQvhArRHnBo/h6eLH1fkCvNlww==}
@@ -3634,13 +3627,9 @@ packages:
     resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
     engines: {node: '>=6'}
 
-  minimatch@5.1.9:
+  minimatch@10.2.6:
-    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
+    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
-    engines: {node: '>=10'}
+    engines: {node: 18 || 20 || >=22}
-
-  minimatch@9.0.7:
-    resolution: {integrity: sha512-MOwgjc8tfrpn5QQEvjijjmDVtMw2oL88ugTevzxQnzRLm6l3fVEF2gzU0kYeYYKD8C66+IdGX6peJ4MyUlUnPg==}
-    engines: {node: '>=16 || 14 >=14.17'}
 
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
@@ -5718,7 +5707,7 @@ snapshots:
       ejs: 3.1.10
       enquirer: 2.3.6
       ignore: 5.3.2
-      minimatch: 9.0.7
+      minimatch: 10.2.6
       nx: 21.6.11
       semver: 7.8.0
       tslib: 2.8.1
@@ -7342,8 +7331,6 @@ snapshots:
 
   bail@2.0.2: {}
 
-  balanced-match@1.0.2: {}
-
   balanced-match@4.0.4: {}
 
   base64-js@1.5.1: {}
@@ -7356,11 +7343,7 @@ snapshots:
       inherits: 2.0.4
       readable-stream: 3.6.2
 
-  brace-expansion@2.1.2:
+  brace-expansion@5.0.8:
-    dependencies:
-      balanced-match: 1.0.2
-
-  brace-expansion@5.0.7:
     dependencies:
       balanced-match: 4.0.4
 
@@ -7721,7 +7704,7 @@ snapshots:
     dependencies:
       dequal: 2.0.3
 
-  dompurify@3.4.11:
+  dompurify@3.4.12:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -7867,7 +7850,7 @@ snapshots:
 
   filelist@1.0.6:
     dependencies:
-      minimatch: 5.1.9
+      minimatch: 10.2.6
 
   flat@5.0.2: {}
 
@@ -8451,7 +8434,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.20
-      dompurify: 3.4.11
+      dompurify: 3.4.12
       es-toolkit: 1.49.0
       katex: 0.16.45
       khroma: 2.1.0
@@ -8702,13 +8685,9 @@ snapshots:
 
   mimic-fn@2.1.0: {}
 
-  minimatch@5.1.9:
+  minimatch@10.2.6:
     dependencies:
-      brace-expansion: 2.1.2
+      brace-expansion: 5.0.8
-
-  minimatch@9.0.7:
-    dependencies:
-      brace-expansion: 5.0.7
 
   minimist@1.2.8: {}
 
@@ -8754,7 +8733,7 @@ snapshots:
       jest-diff: 30.4.1
       jsonc-parser: 3.2.0
       lines-and-columns: 2.0.3
-      minimatch: 9.0.7
+      minimatch: 10.2.6
       node-machine-id: 1.1.12
       npm-run-path: 4.0.1
       open: 8.4.2

pnpm-workspace.yaml

@@ -9,14 +9,13 @@ allowBuilds:
 overrides:
   '@babel/core@<=7.29.0': 7.29.6
   'axios@<1.18.0': 1.18.0
-  'brace-expansion@>=2.0.0 <2.1.2': 2.1.2
+  'dompurify@<=3.4.11': 3.4.12
-  'dompurify@<=3.4.10': 3.4.11
   'esbuild@>=0.27.3 <0.28.1': 0.28.1
   'fast-uri@>=3.0.0 <3.1.4': 3.1.4
   'form-data@>=4.0.0 <4.0.6': 4.0.6
   'js-yaml@<4.3.0': 4.3.0
   'mermaid@>=11.0.0-alpha.1 <=11.14.0': 11.15.0
-  'minimatch@>=9.0.0 <9.0.7': 9.0.7
+  'minimatch@>=5.0.0 <10.2.6': 10.2.6
   '@nx/js>picomatch': 4.0.5
   '@nx/vite>picomatch': 4.0.5
   '@nx/workspace>picomatch': 4.0.5