mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
43ed960f30
The image scan has been red since 10-06 on five advisories in four runtime packages: proxy-addr 2.0.7 (critical, IP spoofing through an IPv4-mapped IPv6 trust subnet), brace-expansion 2.1.4, source-map-js 1.2.1 and @modelcontextprotocol/sdk 1.30.0. brace-expansion had been fixed once already; the ORM squash regenerated the lockfile and took it back to 2.1.4 without anything noticing. The overrides block in server/package.json was meant to hold such floors, but npm reads overrides from the root package.json only, so none of them ever applied: @nestjs/platform-ws kept its own ws 8.21.2 next to the 8.21.3 the block asked for. The floors move to the root, together with new ones for every package this lifts, so the next lockfile regeneration cannot quietly undo them. picomatch ^4 is dropped instead of moved: at the root it would force micromatch's 2.x copy across a major. js-yaml is lifted only inside its 5.x line, the one @nestjs/swagger pins. The SDK goes to 1.31.0, the first fixed release; it stays hoisted, which the CJS path aliases in server/tsconfig.json depend on. dompurify, fast-uri, ip-address and js-yaml come along because npm audit flags the same lockfile for them and each fix is inside the range already used. @mikro-orm/postgresql (with pg), marked and topojson-client are dropped: nothing in src, tests or scripts imports them, and the ORM config names only the SQLite driver. The Postgres driver comes back with a Postgres job that exercises it. npm audit --omit=dev now reports only maplibre-gl, whose fix is the 6.x major tracked separately.