From 30ac5997222c99b3fa29f1cf4fa848666dedda7e Mon Sep 17 00:00:00 2001
From: Abimael Martell <abimex@gmail.com>
Date: Wed, 4 Mar 2026 22:49:34 -0800
Subject: [PATCH] fix: override http-proxy-agent to v7 to resolve audit
 vulnerability (#2974)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: override http-proxy-agent to v7 to resolve GHSA-vpq2-c234-7xj6

* fix: override @tootallnate/once to 3.0.1 instead of bumping http-proxy-agent

Safer fix — keeps http-proxy-agent at v5, only upgrades the vulnerable
transitive dep to its patched version.
---
 apps/api/package.json   | 3 ++-
 apps/api/pnpm-lock.yaml | 9 +++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/apps/api/package.json b/apps/api/package.json
index 38715d488..023831b50 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -182,7 +182,8 @@
       "js-yaml@<3.14.2": ">=3.14.2",
       "qs@<6.14.2": ">=6.14.2",
       "minimatch@<10.2.3": ">=10.2.3",
-      "bn.js@<5.2.3": ">=5.2.3"
+      "bn.js@<5.2.3": ">=5.2.3",
+      "@tootallnate/once@<3.0.1": ">=3.0.1"
     }
   },
   "lint-staged": {
diff --git a/apps/api/pnpm-lock.yaml b/apps/api/pnpm-lock.yaml
index 8b98ab0f3..0a7a7d9e5 100644
--- a/apps/api/pnpm-lock.yaml
+++ b/apps/api/pnpm-lock.yaml
@@ -15,6 +15,7 @@ overrides:
   qs@<6.14.2: '>=6.14.2'
   minimatch@<10.2.3: '>=10.2.3'
   bn.js@<5.2.3: '>=5.2.3'
+  '@tootallnate/once@<3.0.1': '>=3.0.1'
 
 importers:
 
@@ -2553,8 +2554,8 @@ packages:
     resolution: {integrity: sha512-Ck3zFhQhIhi02Hl6T4ZmJsXdnJE+wXcJz5f8klxd4keRYgenMnip3JDPMGDRLbnC/2iGd8P0sBIQqI3KxfVjBg==}
     hasBin: true
 
-  '@tootallnate/once@2.0.0':
-    resolution: {integrity: sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==}
+  '@tootallnate/once@3.0.1':
+    resolution: {integrity: sha512-VyMVKRrpHTT8PnotUeV8L/mDaMwD5DaAKCFLP73zAqAtvF0FCqky+Ki7BYbFCYQmqFyTe9316Ed5zS70QUR9eg==}
     engines: {node: '>= 10'}
 
   '@tsconfig/node10@1.0.12':
@@ -8071,7 +8072,7 @@ snapshots:
 
   '@taplo/cli@0.7.0': {}
 
-  '@tootallnate/once@2.0.0': {}
+  '@tootallnate/once@3.0.1': {}
 
   '@tsconfig/node10@1.0.12':
     optional: true
@@ -9577,7 +9578,7 @@ snapshots:
 
   http-proxy-agent@5.0.0:
     dependencies:
-      '@tootallnate/once': 2.0.0
+      '@tootallnate/once': 3.0.1
       agent-base: 6.0.2
       debug: 4.4.3
     transitivePeerDependencies: