scriptoriumadmin/claude-prism
1
0
Fork 0
mirror of https://github.com/delibae/claude-prism.git synced 2026-08-28 05:14:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: resolve Dependabot security alerts for undici, flatted, and hono

Browse source 
Add pnpm overrides to bump transitive dependencies to patched versions:
- undici >=7.24.0 (fixes CVEs for WebSocket, CRLF injection, request smuggling)
- flatted >=3.4.0 (fixes unbounded recursion DoS)
- hono >=4.12.7 (fixes prototype pollution via __proto__)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
delibae 2026-03-15 00:07:07 +09:00
parent 9778df2c3f
commit 03bec2ac2b
2 changed files with 23 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
package.json
View file

@ -30,7 +30,10 @@
],
"overrides": {
"rollup": ">=4.58.0",
"serialize-javascript": ">=6.0.3"
"serialize-javascript": ">=6.0.3",
"undici": ">=7.24.0",
"flatted": ">=3.4.0",
"hono": ">=4.12.7"
}
}
}

35
pnpm-lock.yaml generated
View file

@ -7,6 +7,9 @@ settings:
overrides:
rollup: '>=4.58.0'
serialize-javascript: '>=6.0.3'
undici: '>=7.24.0'
flatted: '>=3.4.0'
hono: '>=4.12.7'
importers:
@ -1414,7 +1417,7 @@ packages:
resolution: {integrity: sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==}
engines: {node: '>=18.14.1'}
peerDependencies:
hono: ^4
hono: '>=4.12.7'
'@humanfs/core@0.19.1':
resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
@ -4257,8 +4260,8 @@ packages:
resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
engines: {node: '>=16'}
flatted@3.3.4:
resolution: {integrity: sha512-3+mMldrTAPdta5kjX2G2J7iX4zxtnwpdA8Tr2ZSjkyPSanvbZAcy6flmtnXbEybHrDcU9641lxrMfFuUxVz9vA==}
flatted@3.4.1:
resolution: {integrity: sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==}
for-each@0.3.5:
resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
@ -4494,8 +4497,8 @@ packages:
hermes-parser@0.25.1:
resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
hono@4.12.5:
resolution: {integrity: sha512-3qq+FUBtlTHhtYxbxheZgY8NIFnkkC/MR8u5TTsr7YZ3wixryQ3cCwn3iZbg8p8B88iDBBAYSfZDS75t8MN7Vg==}
hono@4.12.8:
resolution: {integrity: sha512-VJCEvtrezO1IAR+kqEYnxUOoStaQPGrCmX3j4wDTNOcD1uRPFpGlwQUIW8niPuvHXaTUxeOUl5MMDGrl+tmO9A==}
engines: {node: '>=16.9.0'}
html-encoding-sniffer@4.0.0:
@ -6149,8 +6152,8 @@ packages:
undici-types@7.16.0:
resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
undici@7.18.2:
resolution: {integrity: sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==}
undici@7.24.2:
resolution: {integrity: sha512-P9J1HWYV/ajFr8uCqk5QixwiRKmB1wOamgS0e+o2Z4A44Ej2+thFVRLG/eA7qprx88XXhnV5Bl8LHXTURpzB3Q==}
engines: {node: '>=20.18.1'}
unenv@2.0.0-rc.24:
@ -8046,9 +8049,9 @@ snapshots:
'@floating-ui/utils@0.2.10': {}
'@hono/node-server@1.19.11(hono@4.12.5)':
'@hono/node-server@1.19.11(hono@4.12.8)':
dependencies:
hono: 4.12.5
hono: 4.12.8
'@humanfs/core@0.19.1': {}
@ -8285,7 +8288,7 @@ snapshots:
'@modelcontextprotocol/sdk@1.27.1(zod@3.25.76)':
dependencies:
'@hono/node-server': 1.19.11(hono@4.12.5)
'@hono/node-server': 1.19.11(hono@4.12.8)
ajv: 8.18.0
ajv-formats: 3.0.1(ajv@8.18.0)
content-type: 1.0.5
@ -8295,7 +8298,7 @@ snapshots:
eventsource-parser: 3.0.6
express: 5.2.1
express-rate-limit: 8.3.0(express@5.2.1)
hono: 4.12.5
hono: 4.12.8
jose: 6.2.0
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
@ -11187,10 +11190,10 @@ snapshots:
flat-cache@4.0.1:
dependencies:
flatted: 3.3.4
flatted: 3.4.1
keyv: 4.5.4
flatted@3.3.4: {}
flatted@3.4.1: {}
for-each@0.3.5:
dependencies:
@ -11466,7 +11469,7 @@ snapshots:
dependencies:
hermes-estree: 0.25.1
hono@4.12.5: {}
hono@4.12.8: {}
html-encoding-sniffer@4.0.0:
dependencies:
@ -12301,7 +12304,7 @@ snapshots:
dependencies:
'@cspotcode/source-map-support': 0.8.1
sharp: 0.34.5
undici: 7.18.2
undici: 7.24.2
workerd: 1.20260301.1
ws: 8.18.0
youch: 4.1.0-beta.10
@ -13556,7 +13559,7 @@ snapshots:
undici-types@7.16.0: {}
undici@7.18.2: {}
undici@7.24.2: {}
unenv@2.0.0-rc.24:
dependencies: