hectorzhao/lislgosms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: mitigate npm dependency advisories

Browse Source
This commit is contained in:
hectorzhao
2026-07-26 00:29:49 +08:00
parent 54617c927e
commit b461532075
11 changed files with 190 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/package-lock.json
Generated
+54 -47
View File
@@ -15,6 +15,7 @@
"@nestjs/swagger": "^11.2.3",
"@prisma/adapter-pg": "^7.9.0",
"@prisma/client": "^7.9.0",
"brace-expansion": "file:vendor/brace-expansion-compat",
"bullmq": "^5.79.2",
"class-transformer": "^0.5.1",
"class-validator": "^0.14.3",
@@ -2918,14 +2919,8 @@
}
},
"node_modules/archiver-utils/node_modules/brace-expansion": {
"version": "1.1.16",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
"concat-map": "0.0.1"
}
"resolved": "node_modules/archiver-utils/node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/archiver-utils/node_modules/glob": {
"version": "7.2.3",
@@ -2960,6 +2955,7 @@
"node": "*"
}
},
"node_modules/archiver-utils/node_modules/minimatch/vendor/brace-expansion-compat": {},
"node_modules/archiver-utils/node_modules/readable-stream": {
"version": "2.3.8",
"resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
@@ -3128,10 +3124,13 @@
}
},
"node_modules/balanced-match": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
"integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
"license": "MIT"
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/base64-js": {
"version": "1.5.1",
@@ -3259,12 +3258,20 @@
}
},
"node_modules/brace-expansion": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
"integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
"resolved": "vendor/brace-expansion-compat",
"link": true
},
"node_modules/brace-expansion-safe": {
"name": "brace-expansion",
"version": "5.0.8",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0"
"balanced-match": "^4.0.2"
},
"engines": {
"node": "20 || >=22"
}
},
"node_modules/browser-or-node": {
@@ -3811,12 +3818,6 @@
"node": "*"
}
},
"node_modules/concat-map": {
"version": "0.0.1",
"resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
"integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
"license": "MIT"
},
"node_modules/concat-stream": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-2.0.0.tgz",
@@ -6645,6 +6646,13 @@
"url": "https://github.com/sponsors/isaacs"
}
},
"node_modules/minimatch/node_modules/brace-expansion": {
"resolved": "node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/minimatch/vendor/brace-expansion-compat": {
"dev": true
},
"node_modules/minimist": {
"version": "1.2.8",
"resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -7676,6 +7684,10 @@
"minimatch": "^5.1.0"
}
},
"node_modules/readdir-glob/node_modules/brace-expansion": {
"resolved": "node_modules/readdir-glob/node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/readdir-glob/node_modules/minimatch": {
"version": "5.1.9",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
@@ -7688,6 +7700,7 @@
"node": ">=10"
}
},
"node_modules/readdir-glob/node_modules/minimatch/vendor/brace-expansion-compat": {},
"node_modules/readdirp": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
@@ -7816,14 +7829,8 @@
}
},
"node_modules/rimraf/node_modules/brace-expansion": {
"version": "1.1.16",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
"concat-map": "0.0.1"
}
"resolved": "node_modules/rimraf/node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/rimraf/node_modules/glob": {
"version": "7.2.3",
@@ -7858,6 +7865,7 @@
"node": "*"
}
},
"node_modules/rimraf/node_modules/minimatch/vendor/brace-expansion-compat": {},
"node_modules/robust-predicates": {
"version": "3.0.3",
"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
@@ -8568,15 +8576,8 @@
}
},
"node_modules/test-exclude/node_modules/brace-expansion": {
"version": "1.1.16",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
"concat-map": "0.0.1"
}
"resolved": "node_modules/test-exclude/node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/test-exclude/node_modules/glob": {
"version": "7.2.3",
@@ -8613,6 +8614,9 @@
"node": "*"
}
},
"node_modules/test-exclude/node_modules/minimatch/vendor/brace-expansion-compat": {
"dev": true
},
"node_modules/through2": {
"version": "4.0.2",
"resolved": "https://registry.npmjs.org/through2/-/through2-4.0.2.tgz",
@@ -9480,14 +9484,8 @@
}
},
"node_modules/zip-stream/node_modules/brace-expansion": {
"version": "1.1.16",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
"concat-map": "0.0.1"
}
"resolved": "node_modules/zip-stream/node_modules/minimatch/vendor/brace-expansion-compat",
"link": true
},
"node_modules/zip-stream/node_modules/glob": {
"version": "7.2.3",
@@ -9521,6 +9519,15 @@
"engines": {
"node": "*"
}
},
"node_modules/zip-stream/node_modules/minimatch/vendor/brace-expansion-compat": {},
"vendor/brace-expansion-compat": {
"name": "brace-expansion",
"version": "5.0.8-compat.1",
"license": "MIT",
"dependencies": {
"brace-expansion-safe": "npm:brace-expansion@5.0.8"
}
}
}
}
api/package.json
+2
View File
@@ -24,6 +24,7 @@
"bullmq": "^5.79.2",
"class-transformer": "^0.5.1",
"class-validator": "^0.14.3",
"brace-expansion": "file:vendor/brace-expansion-compat",
"exceljs": "^4.4.0",
"ioredis": "^5.11.1",
"minio": "^8.0.7",
@@ -41,6 +42,7 @@
"typescript": "^6.0.3"
},
"overrides": {
"brace-expansion": "$brace-expansion",
"exceljs": {
"uuid": "11.1.1"
},
api/vendor/brace-expansion-compat/README.md
Vendored
+6
View File
@@ -0,0 +1,6 @@
# brace-expansion compatibility adapter
Older `minimatch` releases call `require('brace-expansion')` as a function,
while the security-fixed 5.x package exposes a named `expand` function.
This adapter preserves the legacy callable CommonJS API and delegates all
expansion work to the bounded `brace-expansion@5.0.8` implementation.
api/vendor/brace-expansion-compat/index.cjs
Vendored
+11
View File
@@ -0,0 +1,11 @@
'use strict';
const boundedBraceExpansion = require('brace-expansion-safe');
function expand(pattern, options) {
return boundedBraceExpansion.expand(pattern, options);
}
Object.assign(expand, boundedBraceExpansion);
module.exports = expand;
api/vendor/brace-expansion-compat/package.json
Vendored
+11
View File
@@ -0,0 +1,11 @@
{
"name": "brace-expansion",
"version": "5.0.8-compat.1",
"private": true,
"description": "CommonJS compatibility adapter for the bounded brace-expansion 5.0.8 implementation",
"main": "index.cjs",
"license": "MIT",
"dependencies": {
"brace-expansion-safe": "npm:brace-expansion@5.0.8"
}
}