mirror of
https://github.com/nocobase/nocobase.git
synced 2026-10-16 15:07:08 +08:00
YANG QIA
adbadacd8f
The scan was run against an image built before #10542 (it reports pdfjs-dist 5.6.205, which came from the old `^5.3.31`), so pdfjs-dist is already resolved. js-yaml and uuid were not. js-yaml (CVE-2026-84375, fixed in 3.15.2 / 4.3.2) needed no new override: every range in the tree (`^3.13.1`, `^4.1.0`, `^4.1.1`) already admits a patched version, the lockfile was just pinned to stale resolutions. Refreshing them moves `^3.13.1` to 3.15.2 and `^4.x` to 4.3.2. pm2 is the one exception — 7.0.4 still pins js-yaml 4.3.1 exactly. The root `**/pm2/js-yaml` override already covered this repo, but the image installs the create-nocobase-app template, whose own `resolutions` did not carry it, so the fix never reached the published image. Add it there. uuid (CVE-2026-41907, fixed in 11.1.1 / 12.0.1 / 13.0.1 / 14.x) cannot be fixed at the source. Refreshing the lockfile moves `^11`, `^13` and `^14` to patched releases, but `^8`, `^9` and `^10` are capped below every fix and the upstreams have no path forward — sequelize 6.37.8, exceljs 4.4.0 and koa-proxies 0.12.4 all still depend on uuid `^8`/`^9`. Pin `**/uuid` to 11.1.1: it is patched, it is the last line shipping a CommonJS build, and it satisfies `^8` through `^11` consumers. uuid's breaking changes between v11 and v14 are environmental (CommonJS removal, global crypto, dropped Node versions), not API changes, so the langchain packages asking for `^13`/`^14` keep every symbol they import. request must stay on uuid 3.x: it does `require('uuid/v4')`, a subpath the v7+ exports map no longer exposes, so `**/uuid` alone breaks both request and its dependent cos-nodejs-sdk-v5 with ERR_PACKAGE_PATH_NOT_ EXPORTED, taking Tencent COS storage down with it. `**/temp-write/uuid` has to accompany it. temp-write itself is fine on v11 — it calls `uuid.v4()`, which still exists — but it declares the same `uuid@^3.3.2` spec as request, and a yarn v1 lockfile is keyed by `name@range`, so one spec cannot resolve to two versions. Dropping the temp-write entry silently collapses `uuid@^3.3.2` onto 11.1.1 and takes the request guard with it. The two are only effective as a pair. Both are dev-only — request comes from cos-nodejs-sdk-v5 and temp-write from lerna — and a production install of the template contains neither. Also bump @budibase/handlebars-helpers 0.14.0 -> 0.14.3, which moved to uuid `^11.1.1` upstream. Its helper set is unchanged (176 helpers, no additions or removals). mariadb is left alone: the 2.x line ended at 2.5.6 with no backport, the advisories are first fixed in 3.2.4, and connector v3 is incompatible with sequelize 6.
126 lines
4.0 KiB
JSON
126 lines
4.0 KiB
JSON
{
|
|
"name": "nocobase",
|
|
"private": true,
|
|
"workspaces": [
|
|
"packages/*/*",
|
|
"packages/*/*/*"
|
|
],
|
|
"license": "Apache-2.0",
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"licenses": [
|
|
{
|
|
"type": "Apache-2.0",
|
|
"url": "https://www.apache.org/licenses/LICENSE-2.0"
|
|
}
|
|
],
|
|
"scripts": {
|
|
"nocobase": "nocobase-v1",
|
|
"pm": "nocobase-v1 pm",
|
|
"pm2": "nocobase-v1 pm2",
|
|
"dev:umi": "nocobase-v1 dev",
|
|
"dev": "nocobase-v1 dev --rsbuild",
|
|
"dev:client-v2": "nocobase-v1 dev --client-v2-only",
|
|
"dev-server": "nocobase-v1 dev --server",
|
|
"start": "nocobase-v1 start",
|
|
"build": "nocobase-v1 build",
|
|
"build:client-v2": "nocobase-v1 build --client-v2-only",
|
|
"tar": "nocobase-v1 tar",
|
|
"test": "nocobase-v1 test",
|
|
"test:server": "nocobase-v1 test:server",
|
|
"test:server-coverage": "nocobase-v1 test-coverage:server",
|
|
"test:client": "nocobase-v1 test:client",
|
|
"test:client-coverage": "nocobase-v1 test-coverage:client",
|
|
"e2e": "nocobase-v1 e2e",
|
|
"ts": "nocobase-v1 test:server",
|
|
"tc": "nocobase-v1 test:client",
|
|
"benchmark": "nocobase-v1 benchmark",
|
|
"perf": "nocobase-v1 perf",
|
|
"docs": "yarn --cwd docs",
|
|
"doc": "nocobase-v1 doc",
|
|
"doc:cn": "nocobase-v1 doc --lang=zh-CN",
|
|
"postinstall": "nocobase-v1 postinstall",
|
|
"lint": "eslint .",
|
|
"clean": "nocobase-v1 clean",
|
|
"changelog": "auto-changelog -p -t keepachangelog",
|
|
"version:alpha": "lerna version prerelease --preid alpha --force-publish=* --no-git-tag-version -m \"chore(versions): publish packages %s\"",
|
|
"release:force": "lerna publish from-package --yes --no-git-tag-version",
|
|
"release": "lerna publish",
|
|
"git-multi": "node scripts/git-multi.js",
|
|
"run:example": "tsx -r dotenv/config -r tsconfig-paths/register ./examples/index.ts"
|
|
},
|
|
"resolutions": {
|
|
"@ant-design/icons": "^5.6.1",
|
|
"@formily/antd-v5": "1.2.3",
|
|
"@rushstack/ts-command-line": "4.23.7",
|
|
"@rspack/core": "1.7.8",
|
|
"@types/react": "18.3.18",
|
|
"@types/react-dom": "^18.0.0",
|
|
"@typescript-eslint/parser": "^6.2.0",
|
|
"**/@mongodb-js/zstd": "file:./packages/plugins/@nocobase/plugin-ai/npm-shims/@mongodb-js/zstd",
|
|
"**/node-liblzma": "file:./packages/plugins/@nocobase/plugin-ai/npm-shims/node-liblzma",
|
|
"react-router-dom": "^6.30.1",
|
|
"react-router": "^6.30.1",
|
|
"react": "^18.0.0",
|
|
"react-dom": "^18.0.0",
|
|
"nwsapi": "2.2.7",
|
|
"antd": "5.24.2",
|
|
"dayjs": "1.11.13",
|
|
"eslint": "8.57.1",
|
|
"**/@rushstack/node-core-library/ajv": "8.18.0",
|
|
"**/pm2/js-yaml": "4.3.2",
|
|
"**/request/uuid": "3.4.0",
|
|
"**/temp-write/uuid": "3.4.0",
|
|
"**/uuid": "11.1.1",
|
|
"**/qs": "6.16.0"
|
|
},
|
|
"config": {
|
|
"ghooks": {
|
|
"pre-commit": "yarn lint-staged && node ./scripts/addLicense.js",
|
|
"commit-msg": "commitlint --edit"
|
|
}
|
|
},
|
|
"lint-staged": {
|
|
"*.{js,json}": [
|
|
"prettier --write"
|
|
],
|
|
"*.ts?(x)": [
|
|
"eslint --fix --cache --cache-location node_modules/.cache/eslint/"
|
|
]
|
|
},
|
|
"devDependencies": {
|
|
"@alicloud/cdn20180510": "^4.2.2",
|
|
"@commitlint/cli": "^16.1.0",
|
|
"@commitlint/config-conventional": "^16.0.0",
|
|
"@commitlint/prompt-cli": "^16.1.0",
|
|
"@types/react": "18.3.18",
|
|
"@types/react-dom": "^18.0.0",
|
|
"ali-oss": "^6.1.0",
|
|
"auto-changelog": "^2.4.0",
|
|
"eslint-plugin-jest-dom": "^5.0.1",
|
|
"eslint-plugin-prettier": "^5.5.4",
|
|
"eslint-plugin-react": "^7.37.5",
|
|
"eslint-plugin-testing-library": "^5.11.0",
|
|
"ghooks": "^2.0.4",
|
|
"joi": "^17.13.6",
|
|
"lint-staged": "^13.2.3",
|
|
"loadjs": "^4.3.0",
|
|
"patch-package": "^8.0.0",
|
|
"pm2": "^7.0.0",
|
|
"pretty-format": "^24.0.0",
|
|
"pretty-quick": "^3.1.0",
|
|
"react": "^18.0.0",
|
|
"react-dom": "^18.0.0",
|
|
"safe-load-script": "^0.0.1",
|
|
"typescript": "5.1.3",
|
|
"vitest": "^1.5.0"
|
|
},
|
|
"volta": {
|
|
"node": "20.16.0",
|
|
"yarn": "1.22.19"
|
|
},
|
|
"dependencies": {},
|
|
"packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
|
|
}
|