agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-12 21:23:45 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
d2c848320edb14d180d8572f47096d5708389c10
overleaf-cep/package.json
T
Lucie GermainandClaude Opus 4.8 d2c848320e [Security upgrade] bump js-yaml to 4.2.0 in root workspace (#34925) 
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace

GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.

Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency

The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill

The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser

Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.

Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Combine js-yaml resolutions into a single global override

Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).

Note the scoped-vs-global tradeoff in the yarn-security-update skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
2026-09-17 11:17:55 +00:00

231 lines
9.4 KiB
JSON
Raw Blame History

{
"name": "overleaf",
"private": true,
"packageManager": "yarn@4.14.1",
"devDependencies": {
"@eslint/compat": "^2.1.0",
"@eslint/js": "^10.0.1",
"@overleaf/eslint-plugin": "workspace:*",
"@prettier/plugin-pug": "^3.4.0",
"@types/chai": "^4.3.0",
"@types/chai-as-promised": "^7.1.8",
"@types/mocha": "^10.0.6",
"@types/multer": "^2.1.0",
"@typescript-eslint/eslint-plugin": "^8.59.4",
"@typescript-eslint/parser": "^8.59.4",
"@vitest/eslint-plugin": "^1.5.0",
"eslint": "^10.4.0",
"eslint-config-prettier": "^10.0.1",
"eslint-formatter-unix": "^8.40.0",
"eslint-plugin-chai-expect": "^4.0.0",
"eslint-plugin-chai-friendly": "^1.1.0",
"eslint-plugin-cypress": "^4.1.0",
"eslint-plugin-import": "^2.32.0",
"eslint-plugin-mocha": "^11.0.0",
"eslint-plugin-n": "^18.0.0",
"eslint-plugin-promise": "^7.2.1",
"eslint-plugin-unicorn": "^56.0.0",
"globals": "^17.6.0",
"prettier": "3.7.4",
"prettier-plugin-groovy": "0.2.1",
"typescript": "^5.9.3"
},
"engines": {
"node": ">=20.19.0"
},
"resolutions": {
"@xmldom/xmldom": "0.8.13",
"argparse/underscore": "1.13.8",
"east/underscore": "1.13.8",
"js-yaml": "^4.2.0",
"sandboxed-module": "patch:sandboxed-module@npm%3A2.0.4#~/.yarn/patches/sandboxed-module-npm-2.0.4-f8b45aacc9.patch",
"request/tough-cookie": "5.1.2",
"request/form-data": "2.5.6",
"request/qs": "6.15.2",
"@cypress/request/qs": "6.15.2",
"qs": "6.15.2",
"@opentelemetry/api": "1.9.0",
"mocha/serialize-javascript": "7.0.5",
"protobufjs": "7.6.3",
"@protobufjs/utf8": "1.1.1",
"mocha-multi-reporters": "patch:mocha-multi-reporters@npm%3A1.5.1#~/.yarn/patches/mocha-multi-reporters-npm-1.5.1-0a1088aed5.patch",
"pdfjs-dist": "patch:pdfjs-dist@npm%3A5.1.91#~/.yarn/patches/pdfjs-dist-npm-5.1.91.patch",
"referer-parser": "patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch",
"sass": "1.77.1",
"@codemirror/autocomplete": "patch:@codemirror/autocomplete@npm%3A6.18.4#~/.yarn/patches/@codemirror-autocomplete-npm-6.18.4.patch",
"@codemirror/language": "6.12.1",
"@codemirror/lint": "6.9.2",
"@codemirror/search": "patch:@codemirror/search@npm%3A6.5.8#~/.yarn/patches/@codemirror-search-npm-6.5.8.patch",
"@codemirror/state": "6.5.4",
"@codemirror/view": "6.38.6",
"@lezer/common": "1.5.0",
"@lezer/lr": "1.4.7",
"@types/react": "18.3.28",
"@vitest/expect": "4.1.5",
"@vitest/mocker": "4.1.5",
"@vitest/spy": "4.1.5",
"react": "18.3.1",
"react-dom": "18.3.1",
"i18next-scanner/i18next": "23.16.8",
"downshift": "9.0.9",
"body-parser": "patch:body-parser@npm%3A1.20.4#~/.yarn/patches/body-parser-npm-1.20.4.patch",
"cypress-multi-reporters": "patch:cypress-multi-reporters@npm%3A2.0.5#~/.yarn/patches/cypress-multi-reporters-npm-2.0.5.patch",
"forwarded@npm:0.2.0": "patch:forwarded@npm%3A0.2.0#~/.yarn/patches/forwarded-npm-0.2.0.patch",
"multer@npm:2.1.1": "patch:multer@npm%3A2.1.1#~/.yarn/patches/multer-npm-2.1.1.patch",
"node-fetch": "patch:node-fetch@npm%3A2.7.0#~/.yarn/patches/node-fetch-npm-2.7.0.patch",
"passport-oauth2": "patch:passport-oauth2@npm%3A1.6.1#~/.yarn/patches/passport-oauth2-npm-1.6.1.patch",
"send": "patch:send@npm%3A0.19.0#~/.yarn/patches/send-npm-0.19.0.patch",
"serve-static": "1.16.2",
"recurly": "4.12.0",
"mongoose": "8.22.1",
"pg": "8.7.1",
"pg-query-stream": "4.7.1",
"@aws-sdk/client-s3": "3.994.0",
"@aws-sdk/client-ses": "3.994.0",
"@aws-sdk/s3-request-presigner": "3.994.0",
"contentful": "10.8.5",
"@contentful/rich-text-html-renderer": "16.0.2",
"@contentful/rich-text-types": "16.0.2",
"i18next": "23.10.0",
"lodash": "4.18.1",
"express-session": "1.17.2",
"ioredis": "4.27.11",
"knip": "5.64.1",
"chart.js": "4.0.1",
"@customerio/cdp-analytics-node": "0.3.9",
"@google-cloud/bigquery": "8.1.1",
"moment": "2.29.4",
"sequelize-cli": "6.6.0",
"async": "3.2.5",
"dockerode": "4.0.9",
"tar-fs": "3.1.1",
"cluster-key-slot": "1.1.0",
"@octokit/request": "9.2.2",
"randomstring": "1.2.2",
"vite": "7.3.5",
"isomorphic-git": "1.33.1",
"http-status": "1.5.0",
"knex": "2.4.0",
"utf-8-validate": "5.0.8",
"ws@npm:^8": "8.21.0",
"samlp": "7.0.2",
"compression": "1.7.4",
"cookie-parser": "1.4.6",
"react-cookie": "7.2.0",
"react-dropzone": "14.2.3",
"@babel/core": "7.28.5",
"@babel/preset-env": "7.28.5",
"@babel/register": "7.28.3",
"@vitejs/plugin-react": "4.4.1",
"cssnano": "7.1.4",
"mini-css-extract-plugin": "2.7.6",
"nodemon": "3.0.1",
"postcss": "8.5.8",
"postcss-reporter": "7.0.5",
"zod": "4.1.11",
"zod-validation-error": "4.0.1",
"simple-oauth2": "5.0.0",
"@types/simple-oauth2": "5.0.7",
"@phosphor-icons/react": "2.1.7",
"@slack/webhook": "7.0.2",
"@stripe/react-stripe-js": "3.9.0",
"@stripe/stripe-js": "7.7.0",
"cache-flow": "1.9.0",
"focus-trap-react": "11.0.4",
"jose": "4.15.5",
"nodemailer": "8.0.5",
"on-headers": "1.0.2",
"pug": "3.0.3",
"rate-limiter-flexible": "2.4.1",
"react-hook-form": "7.71.1",
"stripe": "18.4.0",
"@babel/plugin-proposal-decorators": "7.28.0",
"@floating-ui/react": "0.27.16",
"@juggle/resize-observer": "3.3.1",
"@streamdown/cjk": "1.0.2",
"@testing-library/dom": "10.4.0",
"@testing-library/user-event": "14.5.2",
"@types/express": "4.17.23",
"@types/recurly__recurly-js": "4.38.0",
"@types/sanitize-html": "2.16.0",
"autoprefixer": "10.4.16",
"babel-plugin-module-resolver": "5.0.2",
"backbone": "1.6.0",
"dompurify": "3.4.0",
"eventsource-client": "1.1.4",
"fake-indexeddb": "6.0.0",
"formik": "2.2.9",
"katex": "0.16.28",
"match-sorter": "6.3.1",
"micromark": "4.0.0",
"pirates": "4.0.6",
"qrcode": "1.5.0",
"react-chartjs-2": "5.0.1",
"react-i18next": "13.3.1",
"react-resizable-panels": "2.1.1",
"rehype-harden": "1.1.7",
"scroll-into-view-if-needed": "2.2.28",
"streamdown": "2.2.0",
"tailwindcss": "3.4.17",
"thread-loader": "patch:thread-loader@npm%3A4.0.2#~/.yarn/patches/thread-loader-npm-4.0.2-dab5735f54.patch",
"unist-util-visit": "5.0.0",
"use-stick-to-bottom": "1.1.1",
"zustand": "5.0.8",
"retry-request@npm:^8.0.0": "patch:retry-request@npm%3A8.0.2#~/.yarn/patches/retry-request-npm-8.0.2-448ad084c8.patch",
"retry-request@npm:^7.0.0": "patch:retry-request@npm%3A7.0.2#~/.yarn/patches/retry-request-npm-7.0.2-a41087680c.patch",
"teeny-request@npm:^10.0.0": "patch:teeny-request@npm%3A10.1.0#~/.yarn/patches/teeny-request-npm-10.1.0.patch",
"teeny-request@npm:^9.0.0": "patch:teeny-request@npm%3A9.0.0#~/.yarn/patches/teeny-request-npm-9.0.0-4d571e3c55.patch",
"@aws-sdk/xml-builder": "3.972.25",
"@babel/plugin-transform-modules-systemjs": "7.29.4",
"fast-xml-builder": "1.1.7",
"fast-xml-parser": "5.7.3",
"ip-address": "10.1.1",
"systeminformation": "5.31.6"
},
"scripts": {
"format": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --check",
"format:fix": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --write --check",
"format:styles": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --check '**/*.{css,scss}'",
"format:styles:fix": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --write --check '**/*.{css,scss}'",
"format:pug": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --check '**/*.pug'",
"format:pug:fix": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --write --check '**/*.pug'",
"format:jenkins": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --check '**/Jenkinsfile'",
"format:jenkins:fix": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --write --check '**/Jenkinsfile'",
"format:monorepo-check": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --check '**/Jenkinsfile' '**/*.md' '**/docker-compose.yml' '**/docker-compose.*.yml' '.agents/**/*.js' '.agents/**/*.md'",
"format:monorepo-check:fix": "prettier --cache --cache-location ./.cache/prettier/.prettier-cache --write --check '**/Jenkinsfile' '**/*.md' '**/docker-compose.yml' '**/docker-compose.*.yml' '.agents/**/*.js' '.agents/**/*.md'",
"lint": "eslint --cache --cache-location ./.cache/eslint/ --max-warnings 0 --format unix .",
"lint:fix": "eslint --cache --cache-location ./.cache/eslint/ --fix ."
},
"workspaces": [
"jobs/mirror-documentation",
"jobs/wiki-algolia",
"libraries/*",
"server-ce/test",
"services/analytics",
"services/chat",
"services/clsi",
"services/clsi-cache",
"services/clsi-lb",
"services/clsi-perf",
"services/docstore",
"services/document-updater",
"services/filestore",
"services/freegeoip",
"services/github-sync",
"services/history-v1",
"services/idp",
"services/latexqc",
"services/notifications",
"services/project-history",
"services/real-time",
"services/templates",
"services/third-party-datastore",
"services/third-party-references",
"services/web",
"tools/dependency-management",
"tools/npm-overrides-helper",
"tools/saas-e2e",
"tools/migrations"
]
}
Reference in New Issue View Git Blame Copy Permalink