chore: resolve dependabot security alerts (pnpm + pip) (#9549)

Browse Source

Python (apps/api):
- cryptography 48.0.1 -> 50.0.0 (PKCS#7 Bleichenbacher oracle, high)

npm (pnpm-workspace.yaml catalog/overrides + lockfile):
- react-router 7.15.1 -> 7.18.1, @react-router/dev -> 7.17.0,
  @react-router/node/serve -> 7.18.1 (DoS, open redirect, XSS, constructor injection)
- sharp ^0.34.3 -> ^0.35.3 (libvips CVEs, high)
- fast-uri -> 3.1.5 via override (host confusion, high)
- js-yaml -> 4.3.0 via override (quadratic CPU DoS, high)
- linkify-it -> 5.0.2 via override (mailto validator DoS, high)
- postcss 8.5.15 -> 8.5.25 (source map path traversal, high/medium)
- undici -> 7.29.0 via override (info disclosure, CRLF/cookie injection)
- sanitize-html 2.17.0 -> 2.17.5 (URI scheme validation bypass, medium)
- valibot -> 1.4.2 via override (flatten() throw, medium)
- body-parser -> 1.20.6 via override (limit bypass DoS, low)

...

This commit is contained in:

sriram veeraghanta

2026-08-05 00:48:59 +05:30

committed by GitHub

parent fa027167f6

commit 31853ab2b8

3 changed files with 457 additions and 338 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

767

pnpm-lock.yaml generated

File diff suppressed because it is too large Load Diff