opensource/rustfs-console
3
0
Fork 0
mirror of https://github.com/rustfs/console.git synced 2026-08-29 03:52:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: fix vulnerabilities in glob and js-yaml dependencies

Browse Source 
- Add pnpm overrides to force glob >=10.5.0 (fixes high severity command injection)
- Add pnpm overrides to force js-yaml >=4.1.1 (fixes moderate severity prototype pollution)
- Update pnpm-lock.yaml with secure dependency versions
This commit is contained in:
overtrue
2025-11-20 20:10:47 +08:00
parent 88cf033e65
commit d3bc8144bf
2 changed files with 46 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+3 -1
View File
@@ -111,7 +111,9 @@
},
"pnpm": {
"overrides": {
"tar": ">=7.5.2"
"tar": ">=7.5.2",
"glob": ">=10.5.0",
"js-yaml": ">=4.1.1"
}
}
}
pnpm-lock.yaml
Generated
+43 -114
View File
@@ -6,6 +6,8 @@ settings:
overrides:
tar: '>=7.5.2'
glob: '>=10.5.0'
js-yaml: '>=4.1.1'
importers:
.:
@@ -1187,10 +1189,15 @@ packages:
resolution:
{ integrity: sha512-aFT2yemJJo+TZCmieA7qnYGQooOS7QfNmYrzGtsYd3g9j5iDP8AimYYAesf79ohjbLG12XxC4nG5DyEnC88AsQ== }
'@isaacs/cliui@8.0.2':
'@isaacs/balanced-match@4.0.1':
resolution:
{ integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA== }
engines: { node: '>=12' }
{ integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ== }
engines: { node: 20 || >=22 }
'@isaacs/brace-expansion@5.0.0':
resolution:
{ integrity: sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA== }
engines: { node: 20 || >=22 }
'@isaacs/fs-minipass@4.0.1':
resolution:
@@ -2078,11 +2085,6 @@ packages:
peerDependencies:
pinia: ^2.3.0
'@pkgjs/parseargs@0.11.0':
resolution:
{ integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg== }
engines: { node: '>=14' }
'@polka/url@1.0.0-next.29':
resolution:
{ integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww== }
@@ -3524,21 +3526,11 @@ packages:
{ integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ== }
engines: { node: '>=8' }
ansi-regex@6.2.2:
resolution:
{ integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg== }
engines: { node: '>=12' }
ansi-styles@4.3.0:
resolution:
{ integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg== }
engines: { node: '>=8' }
ansi-styles@6.2.3:
resolution:
{ integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg== }
engines: { node: '>=12' }
ansis@4.2.0:
resolution:
{ integrity: sha512-HqZ5rWlFjGiV0tDm3UxxgNRqsOTniqoKZu0pIAfh7TZQMGuZK+hH0drySty0si0QXj1ieop4+SkSfPZBPPkHig== }
@@ -4549,10 +4541,6 @@ packages:
resolution:
{ integrity: sha512-X7hshQbLyMJ/3RPhyObLARM2sNxxmRALLKx1+NVFFnQ9gKzmCrxm9+uLIAdBcvc8FNLpctqlQ2V6AE92Ol9UDQ== }
eastasianwidth@0.2.0:
resolution:
{ integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA== }
echarts@5.6.0:
resolution:
{ integrity: sha512-oTbVTsXfKuEhxftHqL5xprgLoc0k7uScAwtryCgWF6hPYFLRwOUHiFmHGCBKP5NPFNkDVopOieyUqYGH8Fa3kA== }
@@ -4589,10 +4577,6 @@ packages:
resolution:
{ integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A== }
emoji-regex@9.2.2:
resolution:
{ integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg== }
encodeurl@2.0.0:
resolution:
{ integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg== }
@@ -5068,10 +5052,10 @@ packages:
{ integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A== }
engines: { node: '>=10.13.0' }
glob@10.4.5:
glob@13.0.0:
resolution:
{ integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg== }
hasBin: true
{ integrity: sha512-tvZgpqk6fz4BaNZ66ZsRaZnbHvP/jG3uKJvAZOwEVUL4RTA5nJeeLYfyN9/VA8NX/V3IBG+hkeuGpKjvELkVhA== }
engines: { node: 20 || >=22 }
global-directory@4.0.1:
resolution:
@@ -5488,10 +5472,6 @@ packages:
{ integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA== }
engines: { node: '>=8' }
jackspeak@3.4.3:
resolution:
{ integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw== }
jiti@2.6.1:
resolution:
{ integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ== }
@@ -5510,9 +5490,9 @@ packages:
resolution:
{ integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ== }
js-yaml@4.1.0:
js-yaml@4.1.1:
resolution:
{ integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA== }
{ integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA== }
hasBin: true
jsdom@27.0.1:
@@ -5962,6 +5942,11 @@ packages:
{ integrity: sha512-r9deDe9p5FJUPZAk3A59wGH7Ii9YrjjWw0jmw/liSbHl2CHiyXj6FcDXDu2K3TjVAXqiJdaw3xxwlZZr9E6nHg== }
hasBin: true
minimatch@10.1.1:
resolution:
{ integrity: sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ== }
engines: { node: 20 || >=22 }
minimatch@3.1.2:
resolution:
{ integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw== }
@@ -6269,10 +6254,6 @@ packages:
{ integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw== }
engines: { node: '>=10' }
package-json-from-dist@1.0.1:
resolution:
{ integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw== }
package-manager-detector@1.5.0:
resolution:
{ integrity: sha512-uBj69dVlYe/+wxj8JOpr97XfsxH/eumMt6HqjNTmJDf/6NO9s+0uxeOneIz3AsPt2m6y9PqzDzd3ATcU17MNfw== }
@@ -6347,10 +6328,10 @@ packages:
resolution:
{ integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw== }
path-scurry@1.11.1:
path-scurry@2.0.1:
resolution:
{ integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA== }
engines: { node: '>=16 || 14 >=14.18' }
{ integrity: sha512-oWyT4gICAu+kaA7QWk/jvCHWarMKNs6pXOGWKDTr7cw4IGcUbW+PeTfbaQiLGheFRpjo6O9J0PmyMfQPjH71oA== }
engines: { node: 20 || >=22 }
path-type@4.0.0:
resolution:
@@ -7109,11 +7090,6 @@ packages:
{ integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g== }
engines: { node: '>=8' }
string-width@5.1.2:
resolution:
{ integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA== }
engines: { node: '>=12' }
string_decoder@1.1.1:
resolution:
{ integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg== }
@@ -7127,11 +7103,6 @@ packages:
{ integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A== }
engines: { node: '>=8' }
strip-ansi@7.1.2:
resolution:
{ integrity: sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA== }
engines: { node: '>=12' }
strip-final-newline@3.0.0:
resolution:
{ integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw== }
@@ -8070,11 +8041,6 @@ packages:
{ integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q== }
engines: { node: '>=10' }
wrap-ansi@8.1.0:
resolution:
{ integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ== }
engines: { node: '>=12' }
wrappy@1.0.2:
resolution:
{ integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ== }
@@ -9201,7 +9167,7 @@ snapshots:
globals: 14.0.0
ignore: 5.3.2
import-fresh: 3.3.1
js-yaml: 4.1.0
js-yaml: 4.1.1
minimatch: 3.1.2
strip-json-comments: 3.1.1
transitivePeerDependencies:
@@ -9359,7 +9325,7 @@ snapshots:
'@typescript-eslint/typescript-estree': 8.46.2(typescript@5.9.3)
debug: 4.4.3
fast-glob: 3.3.3
js-yaml: 4.1.0
js-yaml: 4.1.1
json5: 2.2.3
pathe: 1.1.2
picocolors: 1.1.1
@@ -9388,14 +9354,11 @@ snapshots:
'@ioredis/commands@1.4.0': {}
'@isaacs/cliui@8.0.2':
'@isaacs/balanced-match@4.0.1': {}
'@isaacs/brace-expansion@5.0.0':
dependencies:
string-width: 5.1.2
string-width-cjs: string-width@4.2.3
strip-ansi: 7.1.2
strip-ansi-cjs: strip-ansi@6.0.1
wrap-ansi: 8.1.0
wrap-ansi-cjs: wrap-ansi@7.0.0
'@isaacs/balanced-match': 4.0.1
'@isaacs/fs-minipass@4.0.1':
dependencies:
@@ -10325,9 +10288,6 @@ snapshots:
transitivePeerDependencies:
- magicast
'@pkgjs/parseargs@0.11.0':
optional: true
'@polka/url@1.0.0-next.29': {}
'@poppinss/colors@4.1.5':
@@ -10410,7 +10370,7 @@ snapshots:
'@rollup/plugin-yaml@4.1.2(rollup@4.52.5)':
dependencies:
'@rollup/pluginutils': 5.3.0(rollup@4.52.5)
js-yaml: 4.1.0
js-yaml: 4.1.1
tosource: 2.0.0-alpha.3
optionalDependencies:
rollup: 4.52.5
@@ -11325,7 +11285,7 @@ snapshots:
async-sema: 3.1.1
bindings: 1.5.0
estree-walker: 2.0.2
glob: 10.4.5
glob: 13.0.0
graceful-fs: 4.2.11
node-gyp-build: 4.8.4
picomatch: 4.0.3
@@ -11725,14 +11685,10 @@ snapshots:
ansi-regex@5.0.1: {}
ansi-regex@6.2.2: {}
ansi-styles@4.3.0:
dependencies:
color-convert: 2.0.1
ansi-styles@6.2.3: {}
ansis@4.2.0: {}
anymatch@3.1.3:
@@ -11742,7 +11698,7 @@ snapshots:
archiver-utils@5.0.2:
dependencies:
glob: 10.4.5
glob: 13.0.0
graceful-fs: 4.2.11
is-stream: 2.0.1
lazystream: 1.0.1
@@ -12611,8 +12567,6 @@ snapshots:
earcut@3.0.2: {}
eastasianwidth@0.2.0: {}
echarts@5.6.0:
dependencies:
tslib: 2.3.0
@@ -12638,8 +12592,6 @@ snapshots:
emoji-regex@8.0.0: {}
emoji-regex@9.2.2: {}
encodeurl@2.0.0: {}
end-of-stream@1.4.5:
@@ -13049,14 +13001,11 @@ snapshots:
dependencies:
is-glob: 4.0.3
glob@10.4.5:
glob@13.0.0:
dependencies:
foreground-child: 3.3.1
jackspeak: 3.4.3
minimatch: 9.0.5
minimatch: 10.1.1
minipass: 7.1.2
package-json-from-dist: 1.0.1
path-scurry: 1.11.1
path-scurry: 2.0.1
global-directory@4.0.1:
dependencies:
@@ -13400,12 +13349,6 @@ snapshots:
html-escaper: 2.0.2
istanbul-lib-report: 3.0.1
jackspeak@3.4.3:
dependencies:
'@isaacs/cliui': 8.0.2
optionalDependencies:
'@pkgjs/parseargs': 0.11.0
jiti@2.6.1: {}
jmespath@0.16.0: {}
@@ -13414,7 +13357,7 @@ snapshots:
js-tokens@9.0.1: {}
js-yaml@4.1.0:
js-yaml@4.1.1:
dependencies:
argparse: 2.0.1
@@ -13780,6 +13723,10 @@ snapshots:
mini-svg-data-uri@1.4.4: {}
minimatch@10.1.1:
dependencies:
'@isaacs/brace-expansion': 5.0.0
minimatch@3.1.2:
dependencies:
brace-expansion: 1.1.12
@@ -14297,8 +14244,6 @@ snapshots:
dependencies:
p-limit: 3.1.0
package-json-from-dist@1.0.1: {}
package-manager-detector@1.5.0: {}
pako@1.0.11: {}
@@ -14360,9 +14305,9 @@ snapshots:
path-parse@1.0.7: {}
path-scurry@1.11.1:
path-scurry@2.0.1:
dependencies:
lru-cache: 10.4.3
lru-cache: 11.2.2
minipass: 7.1.2
path-type@4.0.0: {}
@@ -14992,12 +14937,6 @@ snapshots:
is-fullwidth-code-point: 3.0.0
strip-ansi: 6.0.1
string-width@5.1.2:
dependencies:
eastasianwidth: 0.2.0
emoji-regex: 9.2.2
strip-ansi: 7.1.2
string_decoder@1.1.1:
dependencies:
safe-buffer: 5.1.2
@@ -15010,10 +14949,6 @@ snapshots:
dependencies:
ansi-regex: 5.0.1
strip-ansi@7.1.2:
dependencies:
ansi-regex: 6.2.2
strip-final-newline@3.0.0: {}
strip-final-newline@4.0.0: {}
@@ -15172,7 +15107,7 @@ snapshots:
test-exclude@7.0.1:
dependencies:
'@istanbuljs/schema': 0.1.3
glob: 10.4.5
glob: 13.0.0
minimatch: 9.0.5
text-decoder@1.2.3:
@@ -15825,12 +15760,6 @@ snapshots:
string-width: 4.2.3
strip-ansi: 6.0.1
wrap-ansi@8.1.0:
dependencies:
ansi-styles: 6.2.3
string-width: 5.1.2
strip-ansi: 7.1.2
wrappy@1.0.2:
optional: true