From 015123366ce284fa2c300069e249fcaf327806f9 Mon Sep 17 00:00:00 2001 From: Nigel Sheridan-Smith Date: Wed, 10 Jun 2026 15:38:55 +1000 Subject: [PATCH] chore: shell-quote and uuid vulns Co-authored-by: Cursor --- package.json | 4 +++- pnpm-lock.yaml | 32 +++++++++++++++++--------------- 2 files changed, 20 insertions(+), 16 deletions(-) diff --git a/package.json b/package.json index fad00bef53..8d0bcab933 100644 --- a/package.json +++ b/package.json @@ -204,7 +204,9 @@ "@types/react": "^17.0.0", "@types/react-dom": "^17.0.0", "cheerio": "1.0.0-rc.12", - "form-data@2": "~2.5.4" + "form-data@2": "~2.5.4", + "shell-quote": "^1.8.4", + "uuid@^8.3.2": "^11.1.1" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ba5adae8fb..536e70f3db 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,6 +9,8 @@ overrides: '@types/react-dom': ^17.0.0 cheerio: 1.0.0-rc.12 form-data@2: ~2.5.4 + shell-quote: ^1.8.4 + uuid@^8.3.2: ^11.1.1 importers: @@ -7563,8 +7565,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.3: - resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} shellwords@0.1.1: @@ -8333,15 +8335,15 @@ packages: resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==} engines: {node: '>= 0.4.0'} + uuid@11.1.1: + resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==} + hasBin: true + uuid@3.4.0: resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==} deprecated: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. hasBin: true - uuid@8.3.2: - resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} - hasBin: true - v8-compile-cache@2.4.0: resolution: {integrity: sha512-ocyWc3bAHBB/guyqJQVI5o4BZkPhznPYUG2ea80Gond/BgNWpap8TOmLSeeQG7bnh2KMISxskdADG59j7zruhw==} @@ -9719,7 +9721,7 @@ snapshots: safe-buffer: 5.2.1 tough-cookie: 4.1.4 tunnel-agent: 0.6.0 - uuid: 8.3.2 + uuid: 11.1.1 '@cypress/webpack-preprocessor@6.0.4(@babel/core@7.29.0)(@babel/preset-env@7.29.0(@babel/core@7.29.0))(babel-loader@10.0.0(@babel/core@7.29.0)(webpack@5.105.3))(webpack@5.105.3)': dependencies: @@ -14890,7 +14892,7 @@ snapshots: istanbul-lib-coverage: 3.2.2 p-map: 3.0.0 rimraf: 3.0.2 - uuid: 8.3.2 + uuid: 11.1.1 istanbul-lib-report@3.0.1: dependencies: @@ -15489,7 +15491,7 @@ snapshots: launch-editor@2.13.1: dependencies: picocolors: 1.1.1 - shell-quote: 1.8.3 + shell-quote: 1.8.4 lazy-ass@1.6.0: {} @@ -16004,7 +16006,7 @@ snapshots: is-wsl: 2.2.0 semver: 7.7.4 shellwords: 0.1.1 - uuid: 8.3.2 + uuid: 11.1.1 which: 2.0.2 node-preload@0.2.1: @@ -16043,7 +16045,7 @@ snapshots: minimatch: 3.1.5 pidtree: 0.3.1 read-pkg: 3.0.0 - shell-quote: 1.8.3 + shell-quote: 1.8.4 string.prototype.padend: 3.1.6 npm-run-path@4.0.1: @@ -17683,7 +17685,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.3: {} + shell-quote@1.8.4: {} shellwords@0.1.1: {} @@ -17771,7 +17773,7 @@ snapshots: sockjs@0.3.24: dependencies: faye-websocket: 0.11.4 - uuid: 8.3.2 + uuid: 11.1.1 websocket-driver: 0.7.4 socks-proxy-agent@8.0.5: @@ -18557,9 +18559,9 @@ snapshots: utils-merge@1.0.1: {} - uuid@3.4.0: {} + uuid@11.1.1: {} - uuid@8.3.2: {} + uuid@3.4.0: {} v8-compile-cache@2.4.0: {}