fix: Fix 26 security issues in electron, axios, undici and 5 more (#32688)

Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com>
Co-authored-by: Declan Carroll <declan@n8n.io>

package.json

@@ -118,7 +118,6 @@
       "@opentelemetry/core": "2.8.0",
       "@types/node": "^20.17.50",
       "chokidar": "4.0.3",
-      "esbuild": "^0.25.0",
       "multer": "^2.2.0",
       "prebuild-install": "7.1.3",
       "pug": "^3.0.3",
@@ -149,9 +148,6 @@
       "@smithy/config-resolver": ">=4.4.0",
       "@rudderstack/rudder-sdk-node@<=3.0.0": "3.0.0",
       "diff": "8.0.3",
-      "undici@5": "catalog:undici-v6",
-      "undici@6": "catalog:undici-v6",
-      "undici@7": "catalog:undici-v7",
       "tar": "^7.5.16",
       "ajv@6": "6.14.0",
       "ajv@7": "8.18.0",
@@ -176,7 +172,7 @@
       "brace-expansion@<=2.1.0": "2.1.0",
       "@xmldom/xmldom": "0.8.13",
       "yaml@<=2.8.3": "2.8.3",
-      "axios": "1.16.1",
+      "axios": "catalog:",
       "fast-xml-parser": "5.7.2",
       "postcss@<=8.5.9": "8.5.10",
       "@anthropic-ai/sdk@<=0.91.1": "0.91.1",
@@ -191,7 +187,14 @@
       "@opentelemetry/sdk-node@<=0.217.0": "0.217.0",
       "langsmith": "0.6.0",
       "hono": "4.12.25",
-      "node-rsa": "2.0.0"
+      "node-rsa": "2.0.0",
+      "@turbo/darwin-64@<=2.9.18": "2.9.18",
+      "@turbo/linux-64@<=2.9.18": "2.9.18",
+      "@turbo/windows-64@<=2.9.18": "2.9.18",
+      "esbuild": "catalog:",
+      "undici@5": "catalog:undici-v6",
+      "undici@6": "catalog:undici-v6",
+      "undici@7": "catalog:undici-v7"
     },
     "patchedDependencies": {
       "bull@4.16.4": "patches/bull@4.16.4.patch",

packages/@n8n/local-gateway/package.json

@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "@n8n/computer-use": "workspace:*",
-    "electron": "^41.3.0",
+    "electron": "catalog:",
     "electron-store": "^8.2.0"
   },
   "devDependencies": {

packages/@n8n/nodes-langchain/package.json

@@ -213,7 +213,6 @@
     "@n8n/eslint-plugin-community-nodes": "workspace:*",
     "@n8n/vitest-config": "workspace:*",
     "@types/basic-auth": "catalog:",
-    "@types/cheerio": "^0.22.15",
     "@types/html-to-text": "^9.0.1",
     "@types/json-schema": "^7.0.15",
     "@types/mime-types": "catalog:",
@@ -272,7 +271,6 @@
     "@n8n/errors": "workspace:*",
     "@n8n/json-schema-to-zod": "workspace:*",
     "@n8n/typeorm": "0.3.20-16",
-    "mysql2": "3.17.0",
     "@n8n/typescript-config": "workspace:*",
     "@oracle/langchain-oracledb": "0.2.0",
     "@pinecone-database/pinecone": "^5.0.2",
@@ -283,7 +281,7 @@
     "@zilliz/milvus2-sdk-node": "^2.5.7",
     "axios": "catalog:",
     "basic-auth": "catalog:",
-    "cheerio": "1.0.0",
+    "cheerio": "catalog:",
     "chromadb": "^3.0.15",
     "cohere-ai": "7.14.0",
     "d3-dsv": "2.0.0",
@@ -299,6 +297,7 @@
     "mammoth": "1.12.0",
     "mime-types": "catalog:",
     "mongodb": "^6.17.0",
+    "mysql2": "3.17.0",
     "n8n-core": "workspace:*",
     "n8n-nodes-base": "workspace:*",
     "n8n-workflow": "workspace:*",

packages/cli/package.json

@@ -93,16 +93,16 @@
     "@types/yargs-parser": "21.0.0",
     "@vvo/tzdb": "^6.141.0",
     "concurrently": "^8.2.0",
-    "esbuild": "^0.25.0",
+    "esbuild": "catalog:",
     "file-type": "16.5.4",
     "form-data": "catalog:",
     "ioredis-mock": "^8.8.1",
     "jest-mock": "^29.6.2",
     "jest-mock-extended": "^3.0.4",
-    "mjml": "^4.15.3",
     "minifaker": "1.34.1",
-    "nock": "catalog:",
+    "mjml": "^4.15.3",
     "n8n-containers": "workspace:*",
+    "nock": "catalog:",
     "openai": "catalog:",
     "openapi-types": "^12.1.3",
     "supertest": "^7.1.1",
@@ -176,8 +176,8 @@
     "convict": "6.2.5",
     "cookie-parser": "1.4.7",
     "cron": "catalog:",
-    "csv-parse": "catalog:",
     "csrf": "3.1.0",
+    "csv-parse": "catalog:",
     "dotenv": "17.2.3",
     "express": "5.1.0",
     "express-handlebars": "8.0.1",
@@ -206,8 +206,8 @@
     "linkedom": "^0.18.9",
     "lodash": "catalog:",
     "luxon": "catalog:",
-    "multer": "^2.2.0",
     "moment-timezone": "catalog:",
+    "multer": "^2.2.0",
     "n8n-core": "workspace:*",
     "n8n-editor-ui": "workspace:*",
     "n8n-nodes-base": "workspace:*",

packages/nodes-base/nodes/Html/Html.node.ts

@@ -1,4 +1,4 @@
-import cheerio from 'cheerio';
+import * as cheerio from 'cheerio';
 import get from 'lodash/get';
 import type {
 	INodeExecutionData,

packages/nodes-base/nodes/Html/types.ts

@@ -1,6 +1,6 @@
-import type cheerio from 'cheerio';
+import type { CheerioAPI } from 'cheerio';
 
-export type Cheerio = ReturnType<typeof cheerio>;
+export type Cheerio = ReturnType<CheerioAPI>;
 
 export interface IValueData {
 	attribute?: string;

packages/nodes-base/nodes/Html/utils.ts

@@ -26,7 +26,11 @@ const extractFunctions: {
 		}
 		return convert(html, options);
 	},
-	value: ($: Cheerio, _valueData: IValueData): string | undefined => $.val(),
+	value: ($: Cheerio, _valueData: IValueData): string | undefined => {
+		const val = $.val();
+		if (val === undefined) return undefined;
+		return Array.isArray(val) ? val.join(',') : val;
+	},
 };
 
 /**

packages/nodes-base/nodes/HtmlExtract/HtmlExtract.node.ts

@@ -1,4 +1,5 @@
-import cheerio from 'cheerio';
+import * as cheerio from 'cheerio';
+import type { CheerioAPI } from 'cheerio';
 import get from 'lodash/get';
 import type {
 	IDataObject,
@@ -9,7 +10,7 @@ import type {
 } from 'n8n-workflow';
 import { NodeConnectionTypes, NodeOperationError } from 'n8n-workflow';
 
-type Cheerio = ReturnType<typeof cheerio>;
+type Cheerio = ReturnType<CheerioAPI>;
 
 interface IValueData {
 	attribute?: string;
@@ -27,7 +28,11 @@ const extractFunctions: {
 		$.attr(valueData.attribute!),
 	html: ($: Cheerio, _valueData: IValueData): string | undefined => $.html() || undefined,
 	text: ($: Cheerio, _valueData: IValueData): string | undefined => $.text(),
-	value: ($: Cheerio, _valueData: IValueData): string | undefined => $.val(),
+	value: ($: Cheerio, _valueData: IValueData): string | undefined => {
+		const val = $.val();
+		if (val === undefined) return undefined;
+		return Array.isArray(val) ? val.join(',') : val;
+	},
 };
 
 /**

packages/nodes-base/package.json

@@ -880,7 +880,6 @@
     "@types/amqplib": "^0.10.1",
     "@types/aws4": "^1.5.1",
     "@types/basic-auth": "catalog:",
-    "@types/cheerio": "^0.22.15",
     "@types/eventsource": "^1.1.2",
     "@types/express": "catalog:",
     "@types/gm": "^1.25.0",
@@ -923,7 +922,7 @@
     "axios": "catalog:",
     "basic-auth": "catalog:",
     "change-case": "4.1.2",
-    "cheerio": "1.0.0-rc.6",
+    "cheerio": "catalog:",
     "chokidar": "catalog:",
     "cron": "catalog:",
     "csv-parse": "catalog:",

pnpm-workspace.yaml

@@ -90,15 +90,18 @@ catalog:
   '@types/xml2js': ^0.4.14
   '@vitest/coverage-v8': 4.1.1
   agent-browser: 0.26.0
-  axios: 1.16.1
+  axios: 1.18.0
   babel-jest: ^29.7.0
   basic-auth: 2.0.1
   cache-manager: 5.2.3
   callsites: 3.1.0
   chat: ^4.28.1
+  cheerio: 1.1.0
   chokidar: 4.0.3
   cron: 4.4.0
   csv-parse: 6.2.1
+  electron: ^41.7.2
+  esbuild: ^0.28.1
   eslint: 9.29.0
   eslint-plugin-oxlint: ^1.61.0
   fast-check: ^3.23.2
@@ -144,8 +147,8 @@ catalog:
   sanitize-html: 2.12.1
   sass-embedded: ^1.98.0
   semver: 7.7.3
-  source-map-support: 0.5.21
   simple-git: 3.36.0
+  source-map-support: 0.5.21
   stream-json: 1.9.1
   testcontainers: ^11.13.0
   ts-morph: ^27.0.2
@@ -176,10 +179,6 @@ catalogs:
     eslint-plugin-playwright: 2.2.2
     playwright: 1.60.0
     playwright-core: 1.60.0
-  undici-v6:
-    undici: ^6.24.0
-  undici-v7:
-    undici: ^7.26.0
   frontend:
     '@internationalized/date': ^3.9.0
     '@sentry/vue': ^10.36.0
@@ -213,6 +212,10 @@ catalogs:
     '@storybook/vue3-vite': ^10.1.11
     eslint-plugin-storybook: ^10.1.11
     storybook: ^10.1.11
+  undici-v6:
+    undici: ^6.24.0
+  undici-v7:
+    undici: ^7.28.0
 
 minimumReleaseAge: 4320