paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (#987)

Browse Source 
Closes Trivy code-scanning alerts #414-#418 on the backend image.

  brace-expansion  5.0.8  -> 5.0.9   CVE-2026-69152 (high)   DoS via unbounded
                                     intermediate arrays
  ip-address       10.2.0 -> 10.4.0  CVE-2026-69192 (high), CVE-2026-54272 and
                                     CVE-2026-69198 (medium) — SSRF and
                                     trust-boundary bypasses. Needs 10.3.1+ to
                                     clear all three.
  postcss          8.5.18 -> 8.5.23  CVE-2026-69153 (medium) information
                                     disclosure via crafted sourceMappingURL

ip-address and brace-expansion were already in overrides but pinned below the
new fixed versions; the floors just needed raising. postcss reaches the image
through sanitize-html — the direct pin is not an import, it forces the
transitive copy to dedupe to a known version, so it moves with the bump.

Only the backend image is affected: the frontend production stage is
nginx:1.30-alpine and ships no node_modules.

Each lockfile now holds exactly one entry per package, all at or above the
fixed version, and the image installs via npm ci --omit=dev so the lockfile is
authoritative.
This commit is contained in:
Paul Nothaft
2026-08-04 14:35:57 +02:00
committed by GitHub
parent 0ef836df19
commit 6c03feaef5
2 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/package-lock.json
Generated
+13 -13
View File
@@ -1,12 +1,12 @@
{ {
"name": "picpeak-backend", "name": "picpeak-backend",
"version": "3.98.1-beta.0", "version": "3.99.0-beta.0",
"lockfileVersion": 3, "lockfileVersion": 3,
"requires": true, "requires": true,
"packages": { "packages": {
"": { "": {
"name": "picpeak-backend", "name": "picpeak-backend",
"version": "3.98.1-beta.0", "version": "3.99.0-beta.0",
"dependencies": { "dependencies": {
"@aws-sdk/client-s3": "^3.850.0", "@aws-sdk/client-s3": "^3.850.0",
"@aws-sdk/lib-storage": "^3.850.0", "@aws-sdk/lib-storage": "^3.850.0",
@@ -47,7 +47,7 @@
"pdf-lib": "^1.17.1", "pdf-lib": "^1.17.1",
"pdfkit": "^0.17.2", "pdfkit": "^0.17.2",
"pg": "^8.16.3", "pg": "^8.16.3",
"postcss": "8.5.18", "postcss": "8.5.23",
"qrcode": "^1.5.4", "qrcode": "^1.5.4",
"react-i18next": "^15.6.0", "react-i18next": "^15.6.0",
"sanitize-html": "2.17.5", "sanitize-html": "2.17.5",
@@ -4500,9 +4500,9 @@
"license": "MIT" "license": "MIT"
}, },
"node_modules/brace-expansion": { "node_modules/brace-expansion": {
"version": "5.0.8", "version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"balanced-match": "^4.0.2" "balanced-match": "^4.0.2"
@@ -7105,9 +7105,9 @@
} }
}, },
"node_modules/ip-address": { "node_modules/ip-address": {
"version": "10.2.0", "version": "10.4.0",
"resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
"integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
"license": "MIT", "license": "MIT",
"engines": { "engines": {
"node": ">= 12" "node": ">= 12"
@@ -10093,9 +10093,9 @@
} }
}, },
"node_modules/postcss": { "node_modules/postcss": {
"version": "8.5.18", "version": "8.5.23",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.18.tgz", "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
"integrity": "sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==", "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
"funding": [ "funding": [
{ {
"type": "opencollective", "type": "opencollective",
@@ -10112,7 +10112,7 @@
], ],
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"nanoid": "^3.3.12", "nanoid": "^3.3.16",
"picocolors": "^1.1.1", "picocolors": "^1.1.1",
"source-map-js": "^1.2.1" "source-map-js": "^1.2.1"
}, },
backend/package.json
+3 -3
View File
@@ -57,7 +57,7 @@
"pdf-lib": "^1.17.1", "pdf-lib": "^1.17.1",
"pdfkit": "^0.17.2", "pdfkit": "^0.17.2",
"pg": "^8.16.3", "pg": "^8.16.3",
"postcss": "8.5.18", "postcss": "8.5.23",
"qrcode": "^1.5.4", "qrcode": "^1.5.4",
"react-i18next": "^15.6.0", "react-i18next": "^15.6.0",
"sanitize-html": "2.17.5", "sanitize-html": "2.17.5",
@@ -87,13 +87,13 @@
"fast-xml-parser": ">=5.7.0", "fast-xml-parser": ">=5.7.0",
"qs": ">=6.15.2", "qs": ">=6.15.2",
"tar": ">=7.5.21", "tar": ">=7.5.21",
"brace-expansion": ">=5.0.7", "brace-expansion": ">=5.0.9",
"minimatch": ">=9.0.7", "minimatch": ">=9.0.7",
"path-to-regexp": "0.1.13", "path-to-regexp": "0.1.13",
"lodash": ">=4.18.1", "lodash": ">=4.18.1",
"follow-redirects": ">=1.16.0", "follow-redirects": ">=1.16.0",
"@tootallnate/once": ">=3.0.1", "@tootallnate/once": ">=3.0.1",
"ip-address": ">=10.1.1", "ip-address": ">=10.3.1",
"uuid": "^11.1.1", "uuid": "^11.1.1",
"nodemailer": "^9.0.1" "nodemailer": "^9.0.1"
} }