From 06ef8f220646415f1e18cb7496cc85240b2b6ecb Mon Sep 17 00:00:00 2001 From: Arnas Donauskas Date: Mon, 18 May 2026 21:29:48 +0300 Subject: [PATCH] Override transitive vulns: postcss, ip-address, fast-uri, hono MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patches 11 open Dependabot alerts in dependencies pulled in through the shadcn CLI tree (shadcn → @modelcontextprotocol/sdk → @hono/node-server, express-rate-limit, ajv-formats, …). These aren't loaded by the running Next.js app — they only execute when you invoke the shadcn CLI — but the alerts still surface in GitHub's UI, so it's cleaner to pin them. Uses npm `overrides` to force the patched version regardless of what the upstream MCP SDK happens to request: postcss ^8.5.10 — XSS via unescaped (GHSA-qx2v-qp2m-jg93, medium) ip-address ^10.1.1 — XSS in Address6 HTML-emitting methods (GHSA-v2v4-37r5-5v8g, medium) fast-uri ^3.1.2 — path traversal + host confusion via percent-encoded segments / authority delimiters (GHSA-q3j6-qgpj-74h6 high, GHSA-v39h-62p7-jpjc high) hono ^4.12.18 — JSX HTML injection, bodyLimit bypass, Cache middleware Vary leak, CSS injection via style objects, JWT NumericDate validation (GHSA-69xw-7hcm-h432 / 9vqf-7f2p-gf9v / p77w-8qqv-26rm / qp7p-654g-cw7p / hm8q-7f3q-5f36, low–medium) After overrides: postcss 8.5.14 (was nested 8.4.31 inside next + top 8.5.14) ip-address 10.2.0 (was 10.1.0) fast-uri 3.1.2 (was 3.1.0) hono 4.12.19 (was 4.12.14) Verified locally: npm run lint — 0 errors (23 pre-existing warnings) npm run typecheck — clean npm test — 89/89 passed npm run build — succeeded Pair this with #93 (next 16.2.6 bump) to clear all 22 alerts. Each PR is independently revertible. Co-Authored-By: Claude Opus 4.7 (1M context) --- package-lock.json | 46 +++++++++------------------------------------- package.json | 6 ++++++ 2 files changed, 15 insertions(+), 37 deletions(-) diff --git a/package-lock.json b/package-lock.json index 36aa52c..3887c15 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5685,9 +5685,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz", - "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==", + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", + "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", "funding": [ { "type": "github", @@ -6274,9 +6274,9 @@ } }, "node_modules/hono": { - "version": "4.12.14", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.14.tgz", - "integrity": "sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==", + "version": "4.12.19", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.19.tgz", + "integrity": "sha512-xa3eYXYXx68XTT4hZ7dRzsXBhaq85ToSrlUJNoR0gwz/1Ap/CNwX47wfvV7pc/xWhjKVVkLT7zBJy8chhNguqQ==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -6406,9 +6406,9 @@ } }, "node_modules/ip-address": { - "version": "10.1.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz", - "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==", + "version": "10.2.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", + "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", "license": "MIT", "engines": { "node": ">= 12" @@ -7872,34 +7872,6 @@ } } }, - "node_modules/next/node_modules/postcss": { - "version": "8.4.31", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz", - "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==", - "funding": [ - { - "type": "opencollective", - "url": "https://opencollective.com/postcss/" - }, - { - "type": "tidelift", - "url": "https://tidelift.com/funding/github/npm/postcss" - }, - { - "type": "github", - "url": "https://github.com/sponsors/ai" - } - ], - "license": "MIT", - "dependencies": { - "nanoid": "^3.3.6", - "picocolors": "^1.0.0", - "source-map-js": "^1.0.2" - }, - "engines": { - "node": "^10 || ^12 || >=14" - } - }, "node_modules/node-domexception": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz", diff --git a/package.json b/package.json index ffcf181..670a94e 100644 --- a/package.json +++ b/package.json @@ -69,5 +69,11 @@ "tailwindcss": "^4", "typescript": "^6", "vitest": "^4.1.6" + }, + "overrides": { + "postcss": "^8.5.10", + "ip-address": "^10.1.1", + "fast-uri": "^3.1.2", + "hono": "^4.12.18" } }