From 0822fdd1a89fc7732b83321aa20a7cb8cd96bae2 Mon Sep 17 00:00:00 2001 From: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com> Date: Wed, 2 Sep 2026 02:16:03 +0000 Subject: [PATCH] fix(web): override browserslist past the prototype-write advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `pnpm audit` began failing against a lockfile nobody had touched: two high advisories landed against browserslist <=4.28.6 — GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g, a prototype write and an uncaught crash reachable via an untrusted `browserslist-stats.json`. `dev` was green on its last run and is red on its next one for the same reason, so this is time, not a change. browserslist is reached only transitively (`vite-plugin-solid` -> `@babel/core` -> `@babel/helper-compilation-targets`), so no direct dependency can be bumped to reach it. An override is the mechanism, and this file already holds two of them for the same reason. 4.28.2 -> 4.28.8. `pnpm audit` reports no known vulnerabilities, the PWA builds (132 assets) and the suite passes 858/858. --- web/pnpm-lock.yaml | 55 +++++++++++++++++++++-------------------- web/pnpm-workspace.yaml | 6 +++++ 2 files changed, 34 insertions(+), 27 deletions(-) diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index a2bc94e9..ce756aa0 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: '@babel/core': 7.29.7 dompurify: 3.4.14 + browserslist: '>=4.28.7' importers: @@ -542,21 +543,21 @@ packages: solid-js: optional: true - baseline-browser-mapping@2.10.32: - resolution: {integrity: sha512-wbPvpyjJPC0zdfdKXxqEL3Ea+bOMD/87X4lftiJkkaBiuG6ALQy1SLmEd7BSmVCuwCQsBrCamgBoLyfFDD1EPg==} + baseline-browser-mapping@2.11.20: + resolution: {integrity: sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==} engines: {node: '>=6.0.0'} hasBin: true bidi-js@1.0.3: resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==} - browserslist@4.28.2: - resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} + browserslist@4.28.8: + resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true - caniuse-lite@1.0.30001793: - resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==} + caniuse-lite@1.0.30001810: + resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==} chai@6.2.2: resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==} @@ -608,8 +609,8 @@ packages: dompurify@3.4.14: resolution: {integrity: sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==} - electron-to-chromium@1.5.361: - resolution: {integrity: sha512-Q6Hts7N9FnJc5LeGRINFvLhCI9xZmNtTDe5ZbcVezQz7cU4a8Aua3GH1b8J2XY8Al9PF+OCwYqhgsOOheMdvkA==} + electron-to-chromium@1.5.418: + resolution: {integrity: sha512-UzS26r3AEbG5wSoGVpJKqwHIU9zwQN7LHdVIThDrJpS0I5KdlXFMEb8543fhc9dVnIIAST6ar8rhwa00AL5MlA==} entities@6.0.1: resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==} @@ -811,8 +812,8 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - node-releases@2.0.46: - resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==} + node-releases@2.0.54: + resolution: {integrity: sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==} engines: {node: '>=18'} obug@2.1.4: @@ -969,11 +970,11 @@ packages: resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} engines: {node: '>=22.19.0'} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} + update-browserslist-db@1.3.2: + resolution: {integrity: sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: '>=4.28.7' vite-plugin-solid@2.11.12: resolution: {integrity: sha512-FgjPcx2OwX9h6f28jli7A4bG7PP3te8uyakE5iqsmpq3Jqi1TWLgSroC9N6cMfGRU2zXsl4Q6ISvTr2VL0QHpA==} @@ -1185,7 +1186,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.2 + browserslist: 4.28.8 lru-cache: 5.1.1 semver: 6.3.1 @@ -1431,7 +1432,7 @@ snapshots: '@testing-library/dom@10.4.1': dependencies: - '@babel/code-frame': 7.29.0 + '@babel/code-frame': 7.29.7 '@babel/runtime': 7.29.7 '@types/aria-query': 5.0.4 aria-query: 5.3.0 @@ -1568,21 +1569,21 @@ snapshots: optionalDependencies: solid-js: 1.9.13 - baseline-browser-mapping@2.10.32: {} + baseline-browser-mapping@2.11.20: {} bidi-js@1.0.3: dependencies: require-from-string: 2.0.2 - browserslist@4.28.2: + browserslist@4.28.8: dependencies: - baseline-browser-mapping: 2.10.32 - caniuse-lite: 1.0.30001793 - electron-to-chromium: 1.5.361 - node-releases: 2.0.46 - update-browserslist-db: 1.2.3(browserslist@4.28.2) + baseline-browser-mapping: 2.11.20 + caniuse-lite: 1.0.30001810 + electron-to-chromium: 1.5.418 + node-releases: 2.0.54 + update-browserslist-db: 1.3.2(browserslist@4.28.8) - caniuse-lite@1.0.30001793: {} + caniuse-lite@1.0.30001810: {} chai@6.2.2: {} @@ -1622,7 +1623,7 @@ snapshots: optionalDependencies: '@types/trusted-types': 2.0.7 - electron-to-chromium@1.5.361: {} + electron-to-chromium@1.5.418: {} entities@6.0.1: {} @@ -1776,7 +1777,7 @@ snapshots: nanoid@3.3.18: {} - node-releases@2.0.46: {} + node-releases@2.0.54: {} obug@2.1.4: {} @@ -1925,9 +1926,9 @@ snapshots: undici@8.10.0: {} - update-browserslist-db@1.2.3(browserslist@4.28.2): + update-browserslist-db@1.3.2(browserslist@4.28.8): dependencies: - browserslist: 4.28.2 + browserslist: 4.28.8 escalade: 3.2.0 picocolors: 1.1.1 diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml index 4ea7c7f6..7d889a29 100644 --- a/web/pnpm-workspace.yaml +++ b/web/pnpm-workspace.yaml @@ -1,3 +1,9 @@ overrides: '@babel/core': 7.29.7 dompurify: 3.4.14 + # GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g: prototype write and uncaught + # crash via untrusted `browserslist-stats.json`. Reached only transitively — + # `vite-plugin-solid` -> `@babel/core` -> `@babel/helper-compilation-targets` + # — so no direct dependency can be bumped to fix it, and the advisories + # landed against a lockfile nobody had touched. Patched in 4.28.7. + browserslist: '>=4.28.7'