From 927b2e8b5dccbb4d4d5f6f68c71fcc93fc5074ea Mon Sep 17 00:00:00 2001 From: Mariano Fuentes Date: Mon, 20 Jul 2026 23:19:22 -0400 Subject: [PATCH] fix(deps): bump adm-zip 0.5.18 -> 0.6.0 in apps/api (Dependabot #88/#89) adm-zip < 0.6.0 allows a crafted ZIP to trigger a 4GB memory allocation (DoS). This is reachable: apps/api/src/questionnaire/utils/content-extractor.ts runs `new AdmZip(fileBuffer)` on user-uploaded questionnaire files (xlsx/docx are ZIP containers). Bumps the direct dependency to ^0.6.0 (patched) and updates bun.lock. Our usage (new AdmZip, getEntry, getData, addFile, toBuffer) is unchanged in 0.6.0. Supersedes Dependabot PR #3451, which bumped package.json but left bun.lock out of sync. Co-Authored-By: Claude Opus 4.8 --- apps/api/package.json | 2 +- bun.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/api/package.json b/apps/api/package.json index 423679e678..cb34ae6c38 100644 --- a/apps/api/package.json +++ b/apps/api/package.json @@ -89,7 +89,7 @@ "@upstash/ratelimit": "^2.0.8", "@upstash/redis": "^1.34.2", "@upstash/vector": "^1.2.2", - "adm-zip": "^0.5.16", + "adm-zip": "^0.6.0", "ai": "^6.0.175", "archiver": "^7.0.1", "axios": "^1.16.0", diff --git a/bun.lock b/bun.lock index e95936b8d4..c740d501af 100644 --- a/bun.lock +++ b/bun.lock @@ -153,7 +153,7 @@ "@upstash/ratelimit": "^2.0.8", "@upstash/redis": "^1.34.2", "@upstash/vector": "^1.2.2", - "adm-zip": "^0.5.16", + "adm-zip": "^0.6.0", "ai": "^6.0.175", "archiver": "^7.0.1", "axios": "^1.16.0", @@ -3170,7 +3170,7 @@ "acorn-walk": ["acorn-walk@8.3.5", "", { "dependencies": { "acorn": "^8.11.0" } }, "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw=="], - "adm-zip": ["adm-zip@0.5.18", "", {}, "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng=="], + "adm-zip": ["adm-zip@0.6.0", "", {}, "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg=="], "agent-base": ["agent-base@9.0.0", "", {}, "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA=="],