From 9974948b54d5375a5a0698a134ebc928fdab0150 Mon Sep 17 00:00:00 2001 From: Grovy311 Date: Wed, 28 Oct 2026 06:38:09 +0100 Subject: [PATCH] fix(deps): npm audit fix 2026-10-28 (nur Lockfile) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm audit --audit-level=high war im prepush nach dem Baseline-Rollout rot. npm audit fix ohne --force, package.json unverändert. Geändert: - body-parser 2.3.0->2.4.0 - iconv-lite 0.7.2->0.7.3 - zod 4.4.1->4.6.7 Moderat offen (Fix nur per --force bzw. Major): esbuild uuid Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 1 + package-lock.json | 26 ++++++++++++++------------ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index cd1f40f..ee872c6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -819,6 +819,7 @@ Open security points (state at adoption, 2026-10-15; updated 2026-10-17): `estimate-balance-format.ts`, `room-area.ts` – check for ReDoS when inputs can be long; several `react-hooks/exhaustive-deps` warnings in the editor. - Baseline-Stand 2026-10-27 (security-baseline 3a23c7a): `mutation_check.py` zählt Syntax-/Importfehler nicht mehr als getötet (`[UNGÜLTIG]`), Sicherheitstests verlangen konfigurierte ungültige Eingaben (Leerlauf-Sperre). +- Abhängigkeiten 2026-10-28: `npm audit fix` ohne `--force` (nur Lockfile) gegen die High-Funde: body-parser: 2.3.0->2.4.0, iconv-lite: 0.7.2->0.7.3, zod: 4.4.1->4.6.7. Moderat offen (Fix nur per `--force`/Major): esbuild uuid . ## Response Style for Codex diff --git a/package-lock.json b/package-lock.json index 0e0ed4d..8c94ceb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3009,18 +3009,18 @@ "license": "MIT" }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -4938,9 +4938,10 @@ } }, "node_modules/iconv-lite": { - "version": "0.7.2", - "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz", - "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==", + "version": "0.7.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", + "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", + "license": "MIT", "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" }, @@ -8480,9 +8481,10 @@ } }, "node_modules/zod": { - "version": "4.4.1", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.1.tgz", - "integrity": "sha512-a6ENMBBGZBsnlSebQ/eKCguSBeGKSf4O7BPnqVPmYGtpBYI7VSqoVqw+QcB7kPRjbqPwhYTpFbVj/RqNz/CT0Q==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", + "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" }