4c4b3568db
Python (uv.lock, pyproject.toml): - authlib 1.6.6 → 1.6.9 (JWS header injection, OIDC hash binding, Bleichenbacher padding oracle) - pyasn1 0.6.2 → 0.6.3 (unbounded recursion DoS) - pyjwt 2.10.1 → 2.12.1 (unknown crit header extensions - also in integration-tests and crewai) - orjson 3.11.4 → 3.11.7 (deeply nested JSON recursion DoS) - tornado 6.5.2 → 6.5.5 (multipart DoS, incomplete cookie validation) npm (package.json, package-lock.json): - next ^16.1.6 → ^16.1.7 (HTTP smuggling, CSRF bypass, cache DoS, null origin bypass) - fast-xml-parser override updated to >=5.5.6 (numeric entity expansion bypass) - undici override added >=7.24.0 (WebSocket overflow, smuggling, CRLF injection, DoS) - flatted override added >=3.4.0 (unbounded recursion DoS) - svgo override added >=3.3.3 (DOCTYPE entity expansion DoS) - dompurify override added >=3.3.2 (XSS vulnerability)
32 lines
682 B
JSON
32 lines
682 B
JSON
{
|
|
"name": "hindsight",
|
|
"private": true,
|
|
"workspaces": [
|
|
"hindsight-clients/typescript",
|
|
"hindsight-control-plane",
|
|
"hindsight-docs"
|
|
],
|
|
"scripts": {
|
|
"prepare": "./scripts/setup-hooks.sh"
|
|
},
|
|
"overrides": {
|
|
"qs": "^6.14.2",
|
|
"fast-xml-parser": ">=5.5.6",
|
|
"serialize-javascript": "^7.0.3",
|
|
"minimatch": "^3.1.4",
|
|
"undici": ">=7.24.0",
|
|
"flatted": ">=3.4.0",
|
|
"svgo": ">=3.3.3",
|
|
"dompurify": ">=3.3.2",
|
|
"@redocly/openapi-core": {
|
|
"minimatch": "^5.1.8"
|
|
},
|
|
"@typescript-eslint/typescript-estree": {
|
|
"minimatch": "^9.0.7"
|
|
},
|
|
"ajv": "^6.14.0",
|
|
"ajv-formats": {
|
|
"ajv": "^8.18.0"
|
|
}
|
|
}
|
|
}
|