jaedonP opened a new pull request, #4075: URL: https://github.com/apache/incubator-kie-tools/pull/4075
## Summary Updates the pnpm `overrides` in `pnpm-workspace.yaml` so that transitive dependencies resolve to patched releases: - `axios` is forced to `^1.20.0`, which fixes prototype pollution and header override vulnerabilities in older 1.x releases. - `qs` is pinned to `6.16.2` (was `^6.16.0`), which fixes `qs.stringify` failing to encode the key of an empty array when `allowEmptyArrays` is used. - `undici` is raised from `^6.29.0` to `^6.29.1`, which includes further security fixes for the 6.x line. - `follow-redirects` is pinned to `1.16.2`; it is a transitive dependency of `axios` and `http-proxy`. - `express@4>body-parser` is pinned to `~1.20.9` so Express 4 uses a patched `body-parser` once the lockfile is regenerated. - `handlebars` is pinned to `4.7.10`. Remove the pin once the parents that pull in older versions update to a patched release. - `zod` is forced to `^4.6.7` so all transitive `zod` 4.x consumers use the latest patched release. - `uri-js` is replaced with `fast-uri@^3.1.9` for `ajv-formats-draft2019` and `json-refs`, because `uri-js` is unmaintained and carries a known vulnerable dependency. Only the manifest (`pnpm-workspace.yaml`) is changed here. `pnpm-lock.yaml` has to be regenerated with `pnpm bootstrap` (inside `devbox shell`) and is not part of this draft. The `zod` override is a wider bump for consumers that currently pin an older 4.x version, so compatibility should be checked once the lockfile is regenerated. ## Changes | File | Change | |------|--------| | pnpm-workspace.yaml | add `axios` `^1.20.0`, `follow-redirects` `1.16.2`, `express@4>body-parser` `~1.20.9`, `handlebars` `4.7.10`, `zod` `^4.6.7`, and `ajv-formats-draft2019>uri-js` / `json-refs>uri-js` -> `npm:fast-uri@^3.1.9` overrides; raise `qs` `^6.16.0` -> `6.16.2` and `undici` `^6.29.0` -> `^6.29.1`; update the explanatory comments | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
