From 6658853d84ca6735dafd7fbbe6fc7bdd0bc2c62a Mon Sep 17 00:00:00 2001 From: Xiao Yijun Date: Fri, 13 Feb 2026 12:35:51 +0800 Subject: [PATCH] chore: fix security issue --- package.json | 4 +++- pnpm-lock.yaml | 49 +++++++++++++++++++++++++++++++++++++------------ 2 files changed, 40 insertions(+), 13 deletions(-) diff --git a/package.json b/package.json index 98c52f3b406..a9f7d0b8216 100644 --- a/package.json +++ b/package.json @@ -113,7 +113,9 @@ "qs@<6.14.1": "^6.14.1", "altcha-lib@<1.4.1": "^1.4.1", "webpack@>=5.49.0 <=5.104.0": ">=5.104.1", - "webpack@>=5.49.0 <5.104.0": ">=5.104.0" + "webpack@>=5.49.0 <5.104.0": ">=5.104.0", + "axios@<=1.13.4": ">=1.13.5", + "qs@>=6.7.0 <=6.14.1": ">=6.14.2" }, "onlyBuiltDependencies": [ "@swc/core", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5ba0efbcd3b..a514b33de1b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -20,6 +20,8 @@ overrides: altcha-lib@<1.4.1: ^1.4.1 webpack@>=5.49.0 <=5.104.0: '>=5.104.1' webpack@>=5.49.0 <5.104.0: '>=5.104.0' + axios@<=1.13.4: '>=1.13.5' + qs@>=6.7.0 <=6.14.1: '>=6.14.2' importers: @@ -3646,8 +3648,8 @@ packages: resolution: {integrity: sha512-RE3mdQ7P3FRSe7eqCWoeQ/Z9QXrtniSjp1wUjt5nRC3WIpz5rSCve6o3fsZ2aCpJtrZjSZgjwXAoTO5k4tEI0w==} engines: {node: '>=4'} - axios@1.12.2: - resolution: {integrity: sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==} + axios@1.13.5: + resolution: {integrity: sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==} axobject-query@4.1.0: resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==} @@ -5272,6 +5274,15 @@ packages: flatted@3.3.3: resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==} + follow-redirects@1.15.11: + resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==} + engines: {node: '>=4.0'} + peerDependencies: + debug: '*' + peerDependenciesMeta: + debug: + optional: true + follow-redirects@1.15.9: resolution: {integrity: sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==} engines: {node: '>=4.0'} @@ -5299,6 +5310,10 @@ packages: resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==} engines: {node: '>= 6'} + form-data@4.0.5: + resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + engines: {node: '>= 6'} + format@0.2.2: resolution: {integrity: sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==} engines: {node: '>=0.4.x'} @@ -7769,8 +7784,8 @@ packages: resolution: {integrity: sha512-tsSGN1x3h569ZSU1u6diwhltLyfUWDp3YbFHedapTmpBl0B3P6U3+Qptg7xu+v+1io1EwhdPyyRHYbEw0KN2FA==} engines: {node: '>=20'} - qs@6.14.1: - resolution: {integrity: sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==} + qs@6.14.2: + resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==} engines: {node: '>=0.6'} quansync@0.2.10: @@ -13819,10 +13834,10 @@ snapshots: axe-core@4.10.2: {} - axios@1.12.2: + axios@1.13.5: dependencies: - follow-redirects: 1.15.9 - form-data: 4.0.4 + follow-redirects: 1.15.11 + form-data: 4.0.5 proxy-from-env: 1.1.0 transitivePeerDependencies: - debug @@ -13890,7 +13905,7 @@ snapshots: http-errors: 2.0.0 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.14.1 + qs: 6.14.2 raw-body: 2.5.2 type-is: 1.6.18 unpipe: 1.0.0 @@ -14847,7 +14862,7 @@ snapshots: docusaurus-plugin-remote-content@4.0.0(@docusaurus/core@3.9.2(@docusaurus/faster@3.9.2(@docusaurus/types@3.9.2(@swc/core@1.13.3)(acorn@8.15.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)))(@mdx-js/react@3.1.0(@types/react@19.0.1)(react@19.0.0))(@rspack/core@1.7.2)(@swc/core@1.13.3)(acorn@8.15.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(typescript@5.9.2)): dependencies: '@docusaurus/core': 3.9.2(@docusaurus/faster@3.9.2(@docusaurus/types@3.9.2(@swc/core@1.13.3)(acorn@8.15.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)))(@mdx-js/react@3.1.0(@types/react@19.0.1)(react@19.0.0))(@rspack/core@1.7.2)(@swc/core@1.13.3)(acorn@8.15.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(typescript@5.9.2) - axios: 1.12.2 + axios: 1.13.5 picocolors: 1.1.1 pretty-ms: 7.0.1 rimraf: 5.0.10 @@ -15586,7 +15601,7 @@ snapshots: parseurl: 1.3.3 path-to-regexp: 0.1.12 proxy-addr: 2.0.7 - qs: 6.14.1 + qs: 6.14.2 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.0 @@ -15734,6 +15749,8 @@ snapshots: flatted@3.3.3: {} + follow-redirects@1.15.11: {} + follow-redirects@1.15.9: {} for-each@0.3.3: @@ -15757,6 +15774,14 @@ snapshots: hasown: 2.0.2 mime-types: 2.1.35 + form-data@4.0.5: + dependencies: + asynckit: 0.4.0 + combined-stream: 1.0.8 + es-set-tostringtag: 2.1.0 + hasown: 2.0.2 + mime-types: 2.1.35 + format@0.2.2: {} formdata-node@4.4.1: @@ -16572,7 +16597,7 @@ snapshots: is-weakset@2.0.3: dependencies: call-bind: 1.0.7 - get-intrinsic: 1.2.4 + get-intrinsic: 1.3.0 is-what@4.1.16: {} @@ -18566,7 +18591,7 @@ snapshots: dependencies: hookified: 1.15.0 - qs@6.14.1: + qs@6.14.2: dependencies: side-channel: 1.1.0