From 693d841becec60c3b74636a60e487f3df6efbdd0 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 21:24:32 +0000 Subject: [PATCH] fix(security): patch runtime dependency advisories --- .github/workflows/f6-1-fix-runtime-deps.yml | 81 --------------------- api-v3/package-lock.json | 16 ++-- api-v3/package.json | 6 +- web-v2/package-lock.json | 12 +-- web-v2/package.json | 4 +- 5 files changed, 21 insertions(+), 98 deletions(-) delete mode 100644 .github/workflows/f6-1-fix-runtime-deps.yml diff --git a/.github/workflows/f6-1-fix-runtime-deps.yml b/.github/workflows/f6-1-fix-runtime-deps.yml deleted file mode 100644 index 139f2d2..0000000 --- a/.github/workflows/f6-1-fix-runtime-deps.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: F6.1 fix runtime dependencies - -on: - push: - branches: - - 'release/f6-1-presentation-ready' - paths: - - '.github/workflows/f6-1-fix-runtime-deps.yml' - -permissions: - contents: write - -jobs: - fix: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - ref: release/f6-1-presentation-ready - fetch-depth: 0 - - - uses: actions/setup-node@v4 - with: - node-version: '24' - - - name: Pin patched runtime dependency resolutions - run: | - set -Eeuo pipefail - - cd api-v3 - npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0 - npm install --package-lock-only --ignore-scripts - npm audit --omit=dev --audit-level=high - cd .. - - cd web-v2 - npm pkg set dependencies.maplibre-gl=6.4.1 - npm install --package-lock-only --ignore-scripts - npm audit --omit=dev --audit-level=high - cd .. - - - name: Verify resolved patched versions - run: | - set -Eeuo pipefail - node <<'NODE' - const api = require('./api-v3/package-lock.json'); - const web = require('./web-v2/package-lock.json'); - const apiPackages = api.packages ?? {}; - const webPackages = web.packages ?? {}; - - const versions = (packages, dependency) => Object.entries(packages) - .filter(([path]) => path.endsWith(`node_modules/${dependency}`)) - .map(([, metadata]) => metadata.version); - - const assertOnly = (dependency, actual, expected) => { - if (actual.length === 0 || actual.some((version) => version !== expected)) { - throw new Error(`${dependency}: expected only ${expected}, got ${JSON.stringify(actual)}`); - } - console.log(`${dependency}: ${actual.join(', ')}`); - }; - - assertOnly('multer', versions(apiPackages, 'multer'), '2.3.0'); - assertOnly('qs', versions(apiPackages, 'qs'), '6.16.0'); - assertOnly('maplibre-gl', versions(webPackages, 'maplibre-gl'), '6.4.1'); - - const webManifest = require('./web-v2/package.json'); - if (webManifest.dependencies?.['maplibre-gl'] !== '6.4.1') { - throw new Error(`maplibre-gl manifest is ${webManifest.dependencies?.['maplibre-gl']}`); - } - NODE - - - name: Commit patched dependency locks - run: | - set -Eeuo pipefail - rm .github/workflows/f6-1-fix-runtime-deps.yml - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml - git diff --cached --check - git commit -m 'fix(security): patch runtime dependency advisories' - git push origin HEAD:release/f6-1-presentation-ready diff --git a/api-v3/package-lock.json b/api-v3/package-lock.json index 7438a4d..a491901 100644 --- a/api-v3/package-lock.json +++ b/api-v3/package-lock.json @@ -1,12 +1,12 @@ { "name": "dhv2-api", - "version": "0.20.0-2", + "version": "0.29.0-1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "dhv2-api", - "version": "0.20.0-2", + "version": "0.29.0-1", "license": "UNLICENSED", "dependencies": { "@nestjs/common": "^11.0.0", @@ -4166,9 +4166,9 @@ "license": "MIT" }, "node_modules/multer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz", - "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/multer/-/multer-2.3.0.tgz", + "integrity": "sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==", "license": "MIT", "dependencies": { "append-field": "^1.0.0", @@ -4666,9 +4666,9 @@ } }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", diff --git a/api-v3/package.json b/api-v3/package.json index 203bae3..119ab08 100644 --- a/api-v3/package.json +++ b/api-v3/package.json @@ -42,5 +42,9 @@ "ts-node": "^10.9.2", "tsx": "^4.20.6", "typescript": "^5.9.0" + }, + "overrides": { + "multer": "2.3.0", + "qs": "6.16.0" } -} \ No newline at end of file +} diff --git a/web-v2/package-lock.json b/web-v2/package-lock.json index bf67230..8f15991 100644 --- a/web-v2/package-lock.json +++ b/web-v2/package-lock.json @@ -1,14 +1,14 @@ { "name": "dhv2-web", - "version": "0.20.0-2", + "version": "0.23.0-1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "dhv2-web", - "version": "0.20.0-2", + "version": "0.23.0-1", "dependencies": { - "maplibre-gl": "^6.0.0", + "maplibre-gl": "6.4.1", "react": "^19.0.0", "react-dom": "^19.0.0", "react-router": "^8.0.0" @@ -1633,9 +1633,9 @@ } }, "node_modules/maplibre-gl": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.3.0.tgz", - "integrity": "sha512-F0Is48MTzn3DvOEidPjh68E0kuSA7hdzY1YIR0ypPtFgcif3WPtzI1oZFgsv9WtHmarQnbwIXfsf+EfQYvM00A==", + "version": "6.4.1", + "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.4.1.tgz", + "integrity": "sha512-KzxQKtfBu/pSz1C+yW1hNS9eyj2h2lC7ufdAi6/SEt177n3oAfDfmUmslRfJdXY7ReAFBcnvwsqmiyoDhtA9GQ==", "license": "BSD-3-Clause", "dependencies": { "@mapbox/point-geometry": "^1.1.0", diff --git a/web-v2/package.json b/web-v2/package.json index 594fc31..6a645db 100644 --- a/web-v2/package.json +++ b/web-v2/package.json @@ -12,7 +12,7 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "maplibre-gl": "^6.0.0", + "maplibre-gl": "6.4.1", "react": "^19.0.0", "react-dom": "^19.0.0", "react-router": "^8.0.0" @@ -24,4 +24,4 @@ "typescript": "^5.9.0", "vite": "^7.0.0" } -} \ No newline at end of file +}