From e4b8a48042f509dafbd04c5b3b5ce33226343bcc Mon Sep 17 00:00:00 2001
From: nerdCopter <56646290+nerdCopter@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:22:42 -0500
Subject: [PATCH] fix(deps): override adm-zip >=0.6.0 to remediate memory
 allocation vulnerability (#2992)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remediates GHSA-xcpc-8h2w-3j85 (DoS via crafted ZIP file 4GB memory allocation in onnxruntime-node).

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
---
 gitnexus/package-lock.json | 8 ++++----
 gitnexus/package.json      | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/gitnexus/package-lock.json b/gitnexus/package-lock.json
index 23e85358b..e8e006e0a 100644
--- a/gitnexus/package-lock.json
+++ b/gitnexus/package-lock.json
@@ -2151,13 +2151,13 @@
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.5.16",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.16.tgz",
-      "integrity": "sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
       "license": "MIT",
       "optional": true,
       "engines": {
-        "node": ">=12.0"
+        "node": ">=14.0"
       }
     },
     "node_modules/ajv": {
diff --git a/gitnexus/package.json b/gitnexus/package.json
index 5315226f1..61c57c353 100644
--- a/gitnexus/package.json
+++ b/gitnexus/package.json
@@ -120,6 +120,7 @@
     "vitest": "^4.0.18"
   },
   "overrides": {
+    "adm-zip": ">=0.6.0",
     "@huggingface/transformers": {
       "onnxruntime-node": "$onnxruntime-node"
     }