Changeset 2956e4d in Klonkt for package-lock.json


Ignore:
Timestamp:
08/07/2026 03:46:09 PM (5 weeks ago)
Author:
Robin <roboburr@…>
Branches:
main
Children:
718eaeb
Parents:
ee78e03
Message:

npm audit fix: acht kwetsbaarheden terug naar twee

Alleen de lockfile; geen enkele range in package.json hoefde open, dus dit
blijft binnen semver en alle bumps zijn patch-niveau.

body-parser 1.20.5 -> 1.20.6 DoS, limiet werd stil genegeerd
brace-expansion 2.1.0 -> 2.1.4 DoS (drie adviezen)
postcss 8.5.12 -> 8.5.26 pad-traversal via sourceMappingURL
qs 6.14.2/6.15.1 -> 6.15.3 DoS in stringify
express 4.22.1 -> 4.22.2 hing aan de kwetsbare qs
sanitize-html 2.17.3 -> 2.17.5 KRITIEK: XSS via xmp, en

javascript: door de URI-controle

nanoid 3.3.11 -> 3.3.17

sanitize-html was de belangrijkste: daar gaat alle inhoud van buiten doorheen.

576 tests groen op deze boom.

BLIJFT STAAN, want die vragen een breaking upgrade en dat is geen audit fix:

nodemailer <=9.0.0 (high, SMTP-injectie, TLS-validatie, SSRF) -> 9.0.5
uuid <11.1.1 (moderate, buffer-grenzen in v3/v5/v6) -> 14.0.1

Co-Authored-By: Claude Opus 5 <noreply@…>

File:
1 edited

Legend:

Unmodified
Added
Removed

  • package-lock.json

    ree78e03 r2956e4d  
    11{
    22  "name": "klonkt",
    3   "version": "1.6.0-dev",
     3  "version": "1.6.0",
    44  "lockfileVersion": 3,
    55  "requires": true,
    … …  
    77    "": {
    88      "name": "klonkt",
    9       "version": "1.6.0-dev",
     9      "version": "1.6.0",
    1010      "license": "AGPL-3.0-or-later",
    1111      "dependencies": {
    … …  
    680680    },
    681681    "node_modules/body-parser": {
    682       "version": "1.20.5",
    683       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
    684       "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
     682      "version": "1.20.6",
     683      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
     684      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
    685685      "license": "MIT",
    686686      "dependencies": {
    … …  
    704704    },
    705705    "node_modules/brace-expansion": {
    706       "version": "2.1.0",
    707       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
    708       "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
     706      "version": "2.1.4",
     707      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
     708      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
    709709      "license": "MIT",
    710710      "dependencies": {
    … …  
    934934      "license": "MIT"
    935935    },
     936    "node_modules/dayjs": {
     937      "version": "1.11.21",
     938      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
     939      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
     940      "license": "MIT"
     941    },
    936942    "node_modules/debug": {
    937943      "version": "2.6.9",
    … …  
    12061212    },
    12071213    "node_modules/es-object-atoms": {
    1208       "version": "1.1.1",
    1209       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
    1210       "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
     1214      "version": "1.1.2",
     1215      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
     1216      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
    12111217      "license": "MIT",
    12121218      "dependencies": {
    … …  
    12541260    },
    12551261    "node_modules/express": {
    1256       "version": "4.22.1",
    1257       "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
    1258       "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
     1262      "version": "4.22.2",
     1263      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
     1264      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
    12591265      "license": "MIT",
    12601266      "dependencies": {
    12611267        "accepts": "~1.3.8",
    12621268        "array-flatten": "1.1.1",
    1263         "body-parser": "~1.20.3",
     1269        "body-parser": "~1.20.5",
    12641270        "content-disposition": "~0.5.4",
    12651271        "content-type": "~1.0.4",
    … …  
    12801286        "path-to-regexp": "~0.1.12",
    12811287        "proxy-addr": "~2.0.7",
    1282         "qs": "~6.14.0",
     1288        "qs": "~6.15.1",
    12831289        "range-parser": "~1.2.1",
    12841290        "safe-buffer": "5.2.1",
    … …  
    13351341        "type": "opencollective",
    13361342        "url": "https://opencollective.com/express"
    1337       }
    1338     },
    1339     "node_modules/express/node_modules/qs": {
    1340       "version": "6.14.2",
    1341       "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
    1342       "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
    1343       "license": "BSD-3-Clause",
    1344       "dependencies": {
    1345         "side-channel": "^1.1.0"
    1346       },
    1347       "engines": {
    1348         "node": ">=0.6"
    1349       },
    1350       "funding": {
    1351         "url": "https://github.com/sponsors/ljharb"
    13521343      }
    13531344    },
    … …  
    15431534    },
    15441535    "node_modules/hasown": {
    1545       "version": "2.0.3",
    1546       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
    1547       "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
     1536      "version": "2.0.4",
     1537      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
     1538      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
    15481539      "license": "MIT",
    15491540      "dependencies": {
    … …  
    17831774      }
    17841775    },
     1776    "node_modules/launder": {
     1777      "version": "1.7.1",
     1778      "resolved": "https://registry.npmjs.org/launder/-/launder-1.7.1.tgz",
     1779      "integrity": "sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==",
     1780      "license": "MIT",
     1781      "dependencies": {
     1782        "dayjs": "^1.11.7"
     1783      }
     1784    },
    17851785    "node_modules/locate-path": {
    17861786      "version": "5.0.0",
    … …  
    19591959    },
    19601960    "node_modules/nanoid": {
    1961       "version": "3.3.11",
    1962       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
    1963       "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
     1961      "version": "3.3.17",
     1962      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
     1963      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
    19641964      "funding": [
    19651965        {
    … …  
    21562156    },
    21572157    "node_modules/postcss": {
    2158       "version": "8.5.12",
    2159       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
    2160       "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
     2158      "version": "8.5.26",
     2159      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
     2160      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
    21612161      "funding": [
    21622162        {
    … …  
    21752175      "license": "MIT",
    21762176      "dependencies": {
    2177         "nanoid": "^3.3.11",
     2177        "nanoid": "^3.3.17",
    21782178        "picocolors": "^1.1.1",
    21792179        "source-map-js": "^1.2.1"
    … …  
    22842284    },
    22852285    "node_modules/qs": {
    2286       "version": "6.15.1",
    2287       "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
    2288       "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
     2286      "version": "6.15.3",
     2287      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
     2288      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
    22892289      "license": "BSD-3-Clause",
    22902290      "dependencies": {
    2291         "side-channel": "^1.1.0"
     2291        "es-define-property": "^1.0.1",
     2292        "side-channel": "^1.1.1"
    22922293      },
    22932294      "engines": {
    … …  
    24082409    },
    24092410    "node_modules/sanitize-html": {
    2410       "version": "2.17.3",
    2411       "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.3.tgz",
    2412       "integrity": "sha512-Kn4srCAo2+wZyvCNKCSyB2g8RQ8IkX/gQs2uqoSRNu5t9I2qvUyAVvRDiFUVAiX3N3PNuwStY0eNr+ooBHVWEg==",
     2411      "version": "2.17.5",
     2412      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.5.tgz",
     2413      "integrity": "sha512-ZmU1joGRrvoyctKIiuwUxqR6moLoU2Wk+2bMccN6f7UwhAmwYDvWziqPxRDDN2Qip62NqnIrVrT9akbL6Wretg==",
    24132414      "license": "MIT",
    24142415      "dependencies": {
    … …  
    24172418        "htmlparser2": "^10.1.0",
    24182419        "is-plain-object": "^5.0.0",
     2420        "launder": "^1.7.1",
    24192421        "parse-srcset": "^1.0.2",
    24202422        "postcss": "^8.3.11"
    … …  
    24912493    },
    24922494    "node_modules/side-channel": {
    2493       "version": "1.1.0",
    2494       "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
    2495       "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
     2495      "version": "1.1.1",
     2496      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
     2497      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
    24962498      "license": "MIT",
    24972499      "dependencies": {
    24982500        "es-errors": "^1.3.0",
    2499         "object-inspect": "^1.13.3",
    2500         "side-channel-list": "^1.0.0",
     2501        "object-inspect": "^1.13.4",
     2502        "side-channel-list": "^1.0.1",
    25012503        "side-channel-map": "^1.0.1",
    25022504        "side-channel-weakmap": "^1.0.2"
Note: See TracChangeset for help on using the changeset viewer.