diff --git a/.gitea/workflows/audit.yml b/.gitea/workflows/audit.yml index 1472a53f..0386b870 100644 --- a/.gitea/workflows/audit.yml +++ b/.gitea/workflows/audit.yml @@ -91,8 +91,27 @@ jobs: # advisory, the same fail-on-vulnerability stance as cargo-audit above; triage a finding by # bumping the dep (or, if genuinely unfixable + inapplicable, pinning a resolution and # noting why here). + # + # web carries two ignores, the ONLY ones in a blocking tree — both image-size advisories + # (GHSA-w3rx-r6r6-pgpr ICNS, GHSA-5p2g-fcmc-qvqq JXL/HEIF infinite-loop DoS). They are + # unfixable AND unreachable: + # * unfixable — the vulnerable range is `<= 2.0.2` and 2.0.2 IS latest; upstream has + # published no patched release, so no override can clear them. + # * unreachable — image-size rides in under `@unom/ui › @payloadcms/richtext-lexical › + # … › payload`, and @payloadcms/richtext-lexical is a PEER of @unom/ui that only its + # `./richtext` export needs. The console imports section/toast/button/card/dialog/ + # form/*/material/tabs — never `./richtext` — so payload is auto-installed peer weight + # that no bundle, and no request path, ever touches. + # Drop these the moment image-size ships a fix, or @unom/ui marks that peer optional + # (peerDependenciesMeta) and the chain leaves web/bun.lock entirely — either one makes the + # bare `bun audit` green again. Scoped per-tree so sdk/plugin-kit stay strictly fail-on-any. - name: bun audit - run: bun audit + run: | + if [ "${{ matrix.tree }}" = "web" ]; then + bun audit --ignore=GHSA-w3rx-r6r6-pgpr --ignore=GHSA-5p2g-fcmc-qvqq + else + bun audit + fi # Kept OUT of the bun-audit matrix so this tree's known-advisory state can't normalize failure # in a shipping tree. Non-blocking via a step-level `||` (NOT job-level continue-on-error, which diff --git a/web/bun.lock b/web/bun.lock index 40291304..17a30b65 100644 --- a/web/bun.lock +++ b/web/bun.lock @@ -47,11 +47,12 @@ }, "overrides": { "brace-expansion": "^5.0.9", - "dompurify": "^3.4.12", + "dompurify": "^3.4.13", "fast-uri": "^3.1.5", "immutable": "^4.3.9", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "linkify-it": "^5.0.2", + "nanoid": "^3.3.18", "postcss": "^8.5.25", "sharp": "^0.35.3", "tar": "^7.5.21", @@ -1304,7 +1305,7 @@ "dom-helpers": ["dom-helpers@5.2.1", "", { "dependencies": { "@babel/runtime": "^7.8.7", "csstype": "^3.0.2" } }, "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA=="], - "dompurify": ["dompurify@3.4.12", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg=="], + "dompurify": ["dompurify@3.4.13", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ=="], "dot-prop": ["dot-prop@10.2.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw=="], @@ -1580,7 +1581,7 @@ "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="], - "js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="], + "js-yaml": ["js-yaml@4.3.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ=="], "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="], @@ -1774,7 +1775,7 @@ "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="], - "nanoid": ["nanoid@3.3.16", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q=="], + "nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="], "next": ["next@16.2.11", "", { "dependencies": { "@next/env": "16.2.11", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.4.31", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.2.11", "@next/swc-darwin-x64": "16.2.11", "@next/swc-linux-arm64-gnu": "16.2.11", "@next/swc-linux-arm64-musl": "16.2.11", "@next/swc-linux-x64-gnu": "16.2.11", "@next/swc-linux-x64-musl": "16.2.11", "@next/swc-win32-arm64-msvc": "16.2.11", "@next/swc-win32-x64-msvc": "16.2.11", "sharp": "^0.34.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-B339zaqbyK8cmxhoAvLrcwoabwCP1wz21zSzfqxqXAemTu2BXnH7tQnfcglKv1vnMUIDBc+Hth7XODQriTZiRQ=="], diff --git a/web/bun.nix b/web/bun.nix index 5fa68eb2..842b92b7 100644 --- a/web/bun.nix +++ b/web/bun.nix @@ -2619,9 +2619,9 @@ url = "https://registry.npmjs.org/dom-helpers/-/dom-helpers-5.2.1.tgz"; hash = "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA=="; }; - "dompurify@3.4.12" = fetchurl { - url = "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz"; - hash = "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg=="; + "dompurify@3.4.13" = fetchurl { + url = "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz"; + hash = "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ=="; }; "dot-prop@10.2.0" = fetchurl { url = "https://registry.npmjs.org/dot-prop/-/dot-prop-10.2.0.tgz"; @@ -3219,9 +3219,9 @@ url = "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz"; hash = "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ=="; }; - "js-yaml@4.3.0" = fetchurl { - url = "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz"; - hash = "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="; + "js-yaml@4.3.1" = fetchurl { + url = "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz"; + hash = "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ=="; }; "jsesc@3.1.0" = fetchurl { url = "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz"; @@ -3671,9 +3671,9 @@ url = "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz"; hash = "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="; }; - "nanoid@3.3.16" = fetchurl { - url = "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz"; - hash = "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q=="; + "nanoid@3.3.18" = fetchurl { + url = "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz"; + hash = "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="; }; "napi-wasm@1.1.3" = fetchurl { url = "https://registry.npmjs.org/napi-wasm/-/napi-wasm-1.1.3.tgz"; diff --git a/web/package.json b/web/package.json index e16fcd06..bf768ed3 100644 --- a/web/package.json +++ b/web/package.json @@ -62,14 +62,15 @@ }, "overrides": { "tar": "^7.5.21", - "dompurify": "^3.4.12", + "dompurify": "^3.4.13", "linkify-it": "^5.0.2", "sharp": "^0.35.3", "fast-uri": "^3.1.5", "immutable": "^4.3.9", "undici": "^7.29.0", "postcss": "^8.5.25", - "js-yaml": "^4.3.0", + "nanoid": "^3.3.18", + "js-yaml": "^4.3.1", "brace-expansion": "^5.0.9" } }