From 2a41c36f827f3b62244a26e1f2a1ce7882a7b755 Mon Sep 17 00:00:00 2001 From: Bryant Liu Date: Tue, 21 Jul 2026 16:50:17 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=A7=20deps:=20pin=20body-parser@2?= =?UTF-8?q?=20override=20to=20patched=20version=20(GHSA=20DoS=20fix)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Alert #60: body-parser 2.x prior to 2.3.0 silently disables request size enforcement when given an invalid `limit` option, allowing a DoS. Add a pnpm.overrides entry (body-parser@2 -> ^2.3.0) to force the transitive resolution to the patched version without touching any direct dependency declarations. --- package.json | 3 ++- pnpm-lock.yaml | 26 +++++++++++++++++++------- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index aaf8d36dc..bdbd1bac2 100644 --- a/package.json +++ b/package.json @@ -127,7 +127,8 @@ "qs": "^6.15.3", "tar": "^7.5.16", "uuid": ">=11.1.1", - "@langchain/core": "^1.2.1" + "@langchain/core": "^1.2.1", + "body-parser@2": "^2.3.0" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 458db6608..9da0db4ad 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -16,6 +16,7 @@ overrides: tar: ^7.5.16 uuid: '>=11.1.1' '@langchain/core': ^1.2.1 + body-parser@2: ^2.3.0 pnpmfileChecksum: sha256-Ba1Bu9ZW48eqIymOVoJKwAIn7SvtKEytaNxSbWYgaI0= @@ -1401,8 +1402,8 @@ packages: blocked-at@1.2.0: resolution: {integrity: sha512-Ba9yhK4KcFrgqEPgsU0qVGiMimf+VrD9QJo9pgwjg4yl0GXwgOJS8IRx2rPepQjalrmUdGTqX47bSuJLUMLX7w==} - body-parser@2.2.2: - resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==} + body-parser@2.3.0: + resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} brace-expansion@5.0.7: @@ -2356,6 +2357,10 @@ packages: resolution: {integrity: sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==} engines: {node: '>= 0.6'} + type-is@2.1.0: + resolution: {integrity: sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==} + engines: {node: '>= 18'} + typescript-eslint@8.63.0: resolution: {integrity: sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} @@ -3682,17 +3687,17 @@ snapshots: blocked-at@1.2.0: {} - body-parser@2.2.2: + body-parser@2.3.0: dependencies: bytes: 3.1.2 - content-type: 1.0.5 + content-type: 2.0.0 debug: 4.4.3 http-errors: 2.0.1 - iconv-lite: 0.7.2 + iconv-lite: 0.7.3 on-finished: 2.4.1 qs: 6.15.3 raw-body: 3.0.2 - type-is: 2.0.1 + type-is: 2.1.0 transitivePeerDependencies: - supports-color optional: true @@ -3955,7 +3960,7 @@ snapshots: express@5.2.1: dependencies: accepts: 2.0.0 - body-parser: 2.2.2 + body-parser: 2.3.0 content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -4691,6 +4696,13 @@ snapshots: mime-types: 3.0.2 optional: true + type-is@2.1.0: + dependencies: + content-type: 2.0.0 + media-typer: 1.1.0 + mime-types: 3.0.2 + optional: true + typescript-eslint@8.63.0(eslint@10.7.0)(typescript@6.0.3): dependencies: '@typescript-eslint/eslint-plugin': 8.63.0(@typescript-eslint/parser@8.63.0(eslint@10.7.0)(typescript@6.0.3))(eslint@10.7.0)(typescript@6.0.3) From 61a224bf8e5e5f9bd63dee360da90f11320abcd9 Mon Sep 17 00:00:00 2001 From: Bryant Liu Date: Tue, 21 Jul 2026 16:50:28 +0800 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=94=A7=20deps(website):=20pin=20body-?= =?UTF-8?q?parser/webpack-dev-server/shell-quote=20overrides=20to=20patche?= =?UTF-8?q?d=20versions=20(GHSA=20fixes)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Alert #67: body-parser 1.x < 1.20.6 DoS via invalid `limit` value silently disabling size enforcement -> pinned to ^1.20.6 - Alert #66: webpack-dev-server <= 5.2.5 CSRF via internal developer endpoints -> pinned to ^5.2.6 - Alert #65: webpack-dev-server <= 5.2.5 DoS via malformed Host/Origin header -> pinned to ^5.2.6 - Alert #64: shell-quote <= 1.8.4 quadratic-complexity DoS in parse() -> pinned to ^1.9.0 (tightened from the existing >=1.8.4 override) All three are transitive build-tooling dependencies pulled in via the Docusaurus toolchain; fixed via pnpm.overrides, no direct dependency versions changed. --- website/package.json | 7 +++--- website/pnpm-lock.yaml | 55 ++++++++++++------------------------------ 2 files changed, 20 insertions(+), 42 deletions(-) diff --git a/website/package.json b/website/package.json index 9ece33b8a..9f3773764 100644 --- a/website/package.json +++ b/website/package.json @@ -53,7 +53,7 @@ }, "pnpm": { "overrides": { - "shell-quote": ">=1.8.4", + "shell-quote": "^1.9.0", "@babel/plugin-transform-modules-systemjs": "^7.29.4", "fast-uri": "^3.1.2", "http-proxy-middleware": "^3.0.6", @@ -69,10 +69,11 @@ "markdown-it": "^14.2.0", "mermaid": "^11.15.0", "qs": "^6.15.2", - "webpack-dev-server": "^5.2.4", + "webpack-dev-server": "^5.2.6", "@babel/core": "^7.29.6", "uuid": ">=11.1.1", - "websocket-driver": "^0.7.5" + "websocket-driver": "^0.7.5", + "body-parser@1": "^1.20.6" } } } diff --git a/website/pnpm-lock.yaml b/website/pnpm-lock.yaml index 694ae91e9..cc6496520 100644 --- a/website/pnpm-lock.yaml +++ b/website/pnpm-lock.yaml @@ -5,7 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: - shell-quote: '>=1.8.4' + shell-quote: ^1.9.0 '@babel/plugin-transform-modules-systemjs': ^7.29.4 fast-uri: ^3.1.2 http-proxy-middleware: ^3.0.6 @@ -21,10 +21,11 @@ overrides: markdown-it: ^14.2.0 mermaid: ^11.15.0 qs: ^6.15.2 - webpack-dev-server: ^5.2.4 + webpack-dev-server: ^5.2.6 '@babel/core': ^7.29.6 uuid: '>=11.1.1' websocket-driver: ^0.7.5 + body-parser@1: ^1.20.6 importers: @@ -1710,28 +1711,24 @@ packages: engines: {node: '>= 10'} cpu: [arm64] os: [linux] - libc: [glibc] '@node-rs/jieba-linux-arm64-musl@1.10.4': resolution: {integrity: sha512-Y/tiJ1+HeS5nnmLbZOE+66LbsPOHZ/PUckAYVeLlQfpygLEpLYdlh0aPpS5uiaWMjAXYZYdFkpZHhxDmSLpwpw==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - libc: [musl] '@node-rs/jieba-linux-x64-gnu@1.10.4': resolution: {integrity: sha512-WZO8ykRJpWGE9MHuZpy1lu3nJluPoeB+fIJJn5CWZ9YTVhNDWoCF4i/7nxz1ntulINYGQ8VVuCU9LD86Mek97g==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - libc: [glibc] '@node-rs/jieba-linux-x64-musl@1.10.4': resolution: {integrity: sha512-uBBD4S1rGKcgCyAk6VCKatEVQb6EDD5I40v/DxODi5CuZVCANi9m5oee/MQbAoaX7RydA2f0OSCE9/tcwXEwUg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - libc: [musl] '@node-rs/jieba-wasm32-wasi@1.10.4': resolution: {integrity: sha512-Y2umiKHjuIJy0uulNDz9SDYHdfq5Hmy7jY5nORO99B4pySKkcrMjpeVrmWXJLIsEKLJwcCXHxz8tjwU5/uhz0A==} @@ -1838,25 +1835,21 @@ packages: resolution: {integrity: sha512-P0QrGRPbTWu6RKWfN0bDtbnEps3rXH0MWIMreZABoUrVmNQKtXR6e73J3ub6a+di5s2+K0M2LJ9Bh2/H4UsDUA==} cpu: [arm64] os: [linux] - libc: [glibc] '@rspack/binding-linux-arm64-musl@1.7.11': resolution: {integrity: sha512-6ky7R43VMjWwmx3Yx7Jl7faLBBMAgMDt+/bN35RgwjiPgsIByz65EwytUVuW9rikB43BGHvA/eqlnjLrUzNBqw==} cpu: [arm64] os: [linux] - libc: [musl] '@rspack/binding-linux-x64-gnu@1.7.11': resolution: {integrity: sha512-cuOJMfCOvb2Wgsry5enXJ3iT1FGUjdPqtGUBVupQlEG4ntSYsQ2PtF4wIDVasR3wdxC5nQbipOrDiN/u6fYsdQ==} cpu: [x64] os: [linux] - libc: [glibc] '@rspack/binding-linux-x64-musl@1.7.11': resolution: {integrity: sha512-CoK37hva4AmHGh3VCsQXmGr40L36m1/AdnN5LEjUX6kx5rEH7/1nEBN6Ii72pejqDVvk9anEROmPDiPw10tpFg==} cpu: [x64] os: [linux] - libc: [musl] '@rspack/binding-wasm32-wasi@1.7.11': resolution: {integrity: sha512-OtrmnPUVJMxjNa3eDMfHyPdtlLRmmp/aIm0fQHlAOATbZvlGm12q7rhPW5BXTu1yh+1rQ1/uqvz+SzKEZXuJaQ==} @@ -2037,42 +2030,36 @@ packages: engines: {node: '>=10'} cpu: [arm64] os: [linux] - libc: [glibc] '@swc/core-linux-arm64-musl@1.15.43': resolution: {integrity: sha512-6zB6OnpViBxYy4tgY3v2i6AZY9fwkcHZ032UOwtwUuW1d19sdT07qF0kZe6/3UR1tUaK6jjg2rmVcUIBCEYVjQ==} engines: {node: '>=10'} cpu: [arm64] os: [linux] - libc: [musl] '@swc/core-linux-ppc64-gnu@1.15.43': resolution: {integrity: sha512-coxE1ZWdB3uSDVNoEtYNrRi/1epvckZx9cTJ8ICUxTMTxGk+yvQ/Twacp3ruZSaMPGCriUjP86C37VhaT6nyRg==} engines: {node: '>=10'} cpu: [ppc64] os: [linux] - libc: [glibc] '@swc/core-linux-s390x-gnu@1.15.43': resolution: {integrity: sha512-lXfLhs+LpBsD5inuYx+YDH5WsPPBQ95KPUiy8P5wq9ob9xKDZFqwNfU2QW6bGO8NqRO/H9JQomTSt5Yyh+FGfA==} engines: {node: '>=10'} cpu: [s390x] os: [linux] - libc: [glibc] '@swc/core-linux-x64-gnu@1.15.43': resolution: {integrity: sha512-07XnKwTmKy8TGOZG3D9fRnLWGynxPjwQnZLVmBFbo6F+7vHYzBIOuwXEhemrChBWb6yDNZsVCcMWCPX6FDD2xg==} engines: {node: '>=10'} cpu: [x64] os: [linux] - libc: [glibc] '@swc/core-linux-x64-musl@1.15.43': resolution: {integrity: sha512-TJc+bsSIaBh+hZvZ5GRtW/K1bw66TJ9vsUwvVIsZdiWxU5ObLwZvfcnZ3UpgVfMnFibRes9uriJrQNBHEEogRQ==} engines: {node: '>=10'} cpu: [x64] os: [linux] - libc: [musl] '@swc/core-win32-arm64-msvc@1.15.43': resolution: {integrity: sha512-jfd7s2/bUQYkOHLs+LWQNKZdmDa8+sufKLllhpWAhVQ2GDCwsHe3vR/j+OSiItZNtkzFuaawa3+SAKz9y5gYfw==} @@ -2127,42 +2114,36 @@ packages: engines: {node: '>=10'} cpu: [arm64] os: [linux] - libc: [glibc] '@swc/html-linux-arm64-musl@1.15.43': resolution: {integrity: sha512-TweIdl/g9ugkoiYvcL/qbu+gbglDY3TqNxfXH84WXc4rSqEP20owVlxLya2NjVct8LIP2wDrtutpOwAXWC+Eew==} engines: {node: '>=10'} cpu: [arm64] os: [linux] - libc: [musl] '@swc/html-linux-ppc64-gnu@1.15.43': resolution: {integrity: sha512-4oue1pB38/W6mbudp+w0q1jbwxuwdbdbaOj85ay0pisCs213WkgP+MPN8Zqa5VVPjQnVk2CTY9kmEc74XQI/sA==} engines: {node: '>=10'} cpu: [ppc64] os: [linux] - libc: [glibc] '@swc/html-linux-s390x-gnu@1.15.43': resolution: {integrity: sha512-/tceMNvAxK70SKUZtcn3X+K0vcElMGk3i8Sz0CmPdtooso8MZ7WfAvVP1qi3TWgh1rpQ3cC+Al3433AHlET6+w==} engines: {node: '>=10'} cpu: [s390x] os: [linux] - libc: [glibc] '@swc/html-linux-x64-gnu@1.15.43': resolution: {integrity: sha512-YE7ltlTt5ZFl59GsoHTDrIHnCBY8EDBio66CVj4bqkElFXbE/28xmpVE5ksdGoI5c5aQ/8byUCfHxqzCzQQSVg==} engines: {node: '>=10'} cpu: [x64] os: [linux] - libc: [glibc] '@swc/html-linux-x64-musl@1.15.43': resolution: {integrity: sha512-nS20HmbOk+dEEzdosJqqxAeyjMIiS5yrCAti8LUf0+dgr4eRmjkH4MlkjfPjf49aayR8o+eMJ1jsDZ7whx4zog==} engines: {node: '>=10'} cpu: [x64] os: [linux] - libc: [musl] '@swc/html-win32-arm64-msvc@1.15.43': resolution: {integrity: sha512-Yz7aQQhXT/Yc6QcuMDQDZP9jqf2phkVyU+qSu8ZRWEcJgIorrPL6q7YLqMk+MB5PpZyu5XJEODvc1/UVDE1Kyg==} @@ -2678,8 +2659,8 @@ packages: resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==} engines: {node: '>=8'} - body-parser@1.20.5: - resolution: {integrity: sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==} + body-parser@1.20.6: + resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} bonjour-service@1.3.0: @@ -4251,28 +4232,24 @@ packages: engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [glibc] lightningcss-linux-arm64-musl@1.32.0: resolution: {integrity: sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [musl] lightningcss-linux-x64-gnu@1.32.0: resolution: {integrity: sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [glibc] lightningcss-linux-x64-musl@1.32.0: resolution: {integrity: sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [musl] lightningcss-win32-arm64-msvc@1.32.0: resolution: {integrity: sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==} @@ -5650,8 +5627,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.4: - resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} + shell-quote@1.10.0: + resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==} engines: {node: '>= 0.4'} side-channel-list@1.0.1: @@ -6107,8 +6084,8 @@ packages: webpack: optional: true - webpack-dev-server@5.2.5: - resolution: {integrity: sha512-4wZtCquSuv9CKX8oybo+mqxtxZqWz47uM1Ch94lxowBztOhWCbhqvRbfC/mODOwxgV2brY+JGZpHq58/SuVFYg==} + webpack-dev-server@5.2.6: + resolution: {integrity: sha512-HNLRmamRvVavZQ+avceZifmv8hmdUjg43t6MI4SqJDwFdW7RPQwH5vzGhDRZSX59SgfbeHhLnq3g+uooWo7pVw==} engines: {node: '>= 18.12.0'} hasBin: true peerDependencies: @@ -7729,7 +7706,7 @@ snapshots: update-notifier: 6.0.2 webpack: 5.106.2(@swc/core@1.15.43) webpack-bundle-analyzer: 4.10.2 - webpack-dev-server: 5.2.5(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)) + webpack-dev-server: 5.2.6(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)) webpack-merge: 6.0.1 optionalDependencies: '@docusaurus/faster': 3.10.2(@docusaurus/types@3.10.2(@swc/core@1.15.43)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)) @@ -7793,7 +7770,7 @@ snapshots: update-notifier: 6.0.2 webpack: 5.106.2(@swc/core@1.15.43) webpack-bundle-analyzer: 4.10.2 - webpack-dev-server: 5.2.5(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)) + webpack-dev-server: 5.2.6(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)) webpack-merge: 6.0.1 optionalDependencies: '@docusaurus/faster': 3.10.2(@docusaurus/types@3.10.2(@swc/core@1.15.43)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)) @@ -10075,7 +10052,7 @@ snapshots: binary-extensions@2.3.0: {} - body-parser@1.20.5: + body-parser@1.20.6: dependencies: bytes: 3.1.2 content-type: 1.0.5 @@ -11055,7 +11032,7 @@ snapshots: dependencies: accepts: 1.3.8 array-flatten: 1.1.1 - body-parser: 1.20.5 + body-parser: 1.20.6 content-disposition: 0.5.4 content-type: 1.0.5 cookie: 0.7.2 @@ -11751,7 +11728,7 @@ snapshots: launch-editor@2.14.1: dependencies: picocolors: 1.1.1 - shell-quote: 1.8.4 + shell-quote: 1.10.0 layout-base@1.0.2: {} @@ -13620,7 +13597,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.4: {} + shell-quote@1.10.0: {} side-channel-list@1.0.1: dependencies: @@ -14087,7 +14064,7 @@ snapshots: transitivePeerDependencies: - tslib - webpack-dev-server@5.2.5(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)): + webpack-dev-server@5.2.6(tslib@2.8.1)(webpack@5.106.2(@swc/core@1.15.43)): dependencies: '@types/bonjour': 3.5.13 '@types/connect-history-api-fallback': 1.5.4