From cd01a92faac40af398e43cbafecfb31c63dba2ad Mon Sep 17 00:00:00 2001 From: TheRealSpencer <32678829+TheRealSpencer@users.noreply.github.com> Date: Thu, 15 Oct 2026 23:02:38 -0500 Subject: [PATCH] security: dependency floor lifts for open Dependabot advisories (#15132) --- apps/vscode/package.json | 2 +- .../runtime-files/package-lock.json | 8 +++--- .../standalone/runtime-files/package.json | 2 +- bun.lock | 6 ++--- docs/package-lock.json | 27 +++++++++---------- docs/package.json | 5 +++- package.json | 2 +- 7 files changed, 27 insertions(+), 25 deletions(-) diff --git a/apps/vscode/package.json b/apps/vscode/package.json index 44b8202625..3133b8a8a3 100644 --- a/apps/vscode/package.json +++ b/apps/vscode/package.json @@ -496,7 +496,7 @@ "@vscode/codicons": "^0.0.36", "archiver": "^7.0.1", "aws4fetch": "^1.0.20", - "axios": "1.18.0", + "axios": "1.20.0", "better-sqlite3": "^12.4.1", "cheerio": "^1.0.0", "chokidar": "^4.0.1", diff --git a/apps/vscode/standalone/runtime-files/package-lock.json b/apps/vscode/standalone/runtime-files/package-lock.json index 6c44527a06..462fd66149 100644 --- a/apps/vscode/standalone/runtime-files/package-lock.json +++ b/apps/vscode/standalone/runtime-files/package-lock.json @@ -8,7 +8,7 @@ "name": "cline-core", "version": "0.0.1", "dependencies": { - "@grpc/grpc-js": "^1.13.3", + "@grpc/grpc-js": "~1.13.6", "@grpc/reflection": "^1.0.4", "better-sqlite3": "^12.4.1", "grpc-health-check": "^2.0.2", @@ -17,9 +17,9 @@ } }, "node_modules/@grpc/grpc-js": { - "version": "1.13.3", - "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.13.3.tgz", - "integrity": "sha512-FTXHdOoPbZrBjlVLHuKbDZnsTxXv2BlHF57xw6LuThXacXvtkahEPED0CKMk6obZDf65Hv4k3z62eyPNpvinIg==", + "version": "1.13.7", + "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.13.7.tgz", + "integrity": "sha512-Q6KuzM6QCvNbVWOxf9gHCedUUByhVWsfg6QTN/Jk0KJooG5WfJC3HkHDiVGjCmQFo6mhovEX+8B4phpIOaCr/A==", "license": "Apache-2.0", "dependencies": { "@grpc/proto-loader": "^0.7.13", diff --git a/apps/vscode/standalone/runtime-files/package.json b/apps/vscode/standalone/runtime-files/package.json index e27103d065..e7661c3649 100644 --- a/apps/vscode/standalone/runtime-files/package.json +++ b/apps/vscode/standalone/runtime-files/package.json @@ -3,7 +3,7 @@ "version": "0.0.1", "main": "cline-core.js", "dependencies": { - "@grpc/grpc-js": "^1.13.3", + "@grpc/grpc-js": "~1.13.6", "@grpc/reflection": "^1.0.4", "better-sqlite3": "^12.4.1", "grpc-health-check": "^2.0.2", diff --git a/bun.lock b/bun.lock index f65a6ebca9..460ce193eb 100644 --- a/bun.lock +++ b/bun.lock @@ -400,7 +400,7 @@ "@vscode/codicons": "^0.0.36", "archiver": "^7.0.1", "aws4fetch": "^1.0.20", - "axios": "1.18.0", + "axios": "1.20.0", "better-sqlite3": "^12.4.1", "cheerio": "^1.0.0", "chokidar": "^4.0.1", @@ -836,7 +836,7 @@ "@sap-cloud-sdk/openapi": "4.9.1", "@sap-cloud-sdk/resilience": "4.9.1", "@sap-cloud-sdk/util": "4.9.1", - "axios": "1.18.0", + "axios": "1.20.0", "diff": "8.0.4", "fast-uri": ">=3.1.4", "js-yaml": ">=4.3.2 <5", @@ -2872,7 +2872,7 @@ "axe-core": ["axe-core@4.13.0", "", {}, "sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A=="], - "axios": ["axios@1.18.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.5", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw=="], + "axios": ["axios@1.20.0", "", { "dependencies": { "follow-redirects": "^1.16.0", "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } }, "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg=="], "azure-devops-node-api": ["azure-devops-node-api@12.5.0", "", { "dependencies": { "tunnel": "0.0.6", "typed-rest-client": "^1.8.4" } }, "sha512-R5eFskGvOm3U/GzeAuxRkUsAl0hrAwGgWn6zAd2KrZmrEhWZVqLew4OOupbQlXUuojUzpGtq62SmdhJ06N88og=="], diff --git a/docs/package-lock.json b/docs/package-lock.json index b5c932ce68..fb378f2969 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -3185,13 +3185,13 @@ } }, "node_modules/axios": { - "version": "1.18.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz", - "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", - "form-data": "^4.0.5", + "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } @@ -3400,9 +3400,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -4476,16 +4476,15 @@ } }, "node_modules/engine.io": { - "version": "6.6.9", - "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.9.tgz", - "integrity": "sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg==", + "version": "6.6.11", + "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.11.tgz", + "integrity": "sha512-z34mGpLoY/82ZbkX1LqGMIaf3wjVMPL6gVC681QDqnmzJ26synI8qAE32P+a7UazmpJZ8UGrFIeAavgRfXzYrg==", "license": "MIT", "dependencies": { "@types/cors": "^2.8.12", "@types/node": ">=10.0.0", "@types/ws": "^8.5.12", "accepts": "~1.3.4", - "base64id": "2.0.0", "cookie": "~0.7.2", "cors": "~2.8.5", "debug": "~4.4.1", @@ -6432,9 +6431,9 @@ } }, "node_modules/ip-address": { - "version": "10.4.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz", - "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==", + "version": "10.7.4", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz", + "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/docs/package.json b/docs/package.json index ad1f926d0a..0e3fd63482 100644 --- a/docs/package.json +++ b/docs/package.json @@ -20,7 +20,10 @@ "js-yaml": ">=4.3.2 <5", "tar": ">=7.5.21", "body-parser@<1.20.6": "1.20.6", - "axios@<1.18.0": "1.18.0", + "axios": ">=1.20.0 <2", + "engine.io": ">=6.6.10 <7", + "brace-expansion@<2": "1.1.21", + "ip-address": ">=10.7.1 <11", "qs": ">=6.15.2", "express@<=4.20.0": "4.20.0", "serve-static@<=1.16.0": "1.16.0", diff --git a/package.json b/package.json index ef6799c8aa..a0f5c16fde 100644 --- a/package.json +++ b/package.json @@ -66,7 +66,7 @@ "typescript": "^5.9.3" }, "overrides": { - "axios": "1.18.0", + "axios": "1.20.0", "fast-uri": ">=3.1.4", "undici": ">=7.29.0 <8", "@opentui/core": "0.4.3",