From 1921a0363b0d5ec6233d261b2a2eac35599c1fe8 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Fri, 5 Dec 2025 17:38:03 +0800 Subject: [PATCH 1/2] [WIP] Update auth0/node-jws to version 3.2.3 or 4.0.1 (#482) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: samanhappy <2755122+samanhappy@users.noreply.github.com> --- package.json | 3 ++- pnpm-lock.yaml | 17 +++++++++-------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index 9b388a5..fa3b818 100644 --- a/package.json +++ b/package.json @@ -132,7 +132,8 @@ "pnpm": { "overrides": { "brace-expansion@1.1.11": "1.1.12", - "brace-expansion@2.0.1": "2.0.2" + "brace-expansion@2.0.1": "2.0.2", + "jws@3.2.2": "4.0.1" } } } \ No newline at end of file diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 63fd7d1..d8b68a9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,7 @@ settings: overrides: brace-expansion@1.1.11: 1.1.12 brace-expansion@2.0.1: 2.0.2 + jws@3.2.2: 4.0.1 importers: @@ -3230,11 +3231,11 @@ packages: resolution: {integrity: sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==} engines: {node: '>=12', npm: '>=6'} - jwa@1.4.2: - resolution: {integrity: sha512-eeH5JO+21J78qMvTIDdBXidBd6nG2kZjg5Ohz/1fpa28Z4CcsWUzJ1ZZyFq/3z3N17aZy+ZuBoHljASbL1WfOw==} + jwa@2.0.1: + resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==} - jws@3.2.2: - resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==} + jws@4.0.1: + resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==} keyv@4.5.4: resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==} @@ -7830,7 +7831,7 @@ snapshots: jsonwebtoken@9.0.2: dependencies: - jws: 3.2.2 + jws: 4.0.1 lodash.includes: 4.3.0 lodash.isboolean: 3.0.3 lodash.isinteger: 4.0.4 @@ -7841,15 +7842,15 @@ snapshots: ms: 2.1.3 semver: 7.7.2 - jwa@1.4.2: + jwa@2.0.1: dependencies: buffer-equal-constant-time: 1.0.1 ecdsa-sig-formatter: 1.0.11 safe-buffer: 5.2.1 - jws@3.2.2: + jws@4.0.1: dependencies: - jwa: 1.4.2 + jwa: 2.0.1 safe-buffer: 5.2.1 keyv@4.5.4: From 71667dab2c26dc9910be3a3983df0cdb93768414 Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Fri, 5 Dec 2025 17:40:29 +0800 Subject: [PATCH 2/2] Fix validator security vulnerability CVE in isLength() (#484) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: samanhappy <2755122+samanhappy@users.noreply.github.com> --- package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index fa3b818..66ffa45 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,7 @@ "dotenv": "^16.6.1", "dotenv-expand": "^12.0.2", "express": "^4.21.2", - "express-validator": "^7.2.1", + "express-validator": "^7.3.1", "i18next": "^25.5.0", "i18next-fs-backend": "^2.6.0", "jsonwebtoken": "^9.0.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d8b68a9..cb4800b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -59,8 +59,8 @@ importers: specifier: ^4.21.2 version: 4.22.0 express-validator: - specifier: ^7.2.1 - version: 7.2.1 + specifier: ^7.3.1 + version: 7.3.1 i18next: specifier: ^25.5.0 version: 25.6.0(typescript@5.9.2) @@ -2629,8 +2629,8 @@ packages: peerDependencies: express: '>= 4.11' - express-validator@7.2.1: - resolution: {integrity: sha512-CjNE6aakfpuwGaHQZ3m8ltCG2Qvivd7RHtVMS/6nVxOM7xVGqr4bhflsm4+N5FP5zI7Zxp+Hae+9RE+o8e3ZOQ==} + express-validator@7.3.1: + resolution: {integrity: sha512-IGenaSf+DnWc69lKuqlRE9/i/2t5/16VpH5bXoqdxWz1aCpRvEdrBuu1y95i/iL5QP8ZYVATiwLFhwk3EDl5vg==} engines: {node: '>= 8.0.0'} express@4.22.0: @@ -4482,8 +4482,8 @@ packages: resolution: {integrity: sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==} engines: {node: '>=10.12.0'} - validator@13.12.0: - resolution: {integrity: sha512-c1Q0mCiPlgdTVVVIJIrBuxNicYE+t/7oKeI9MWLj3fh/uq2Pxh/3eeWbVZ4OcGW1TUf53At0njHw5SMdA3tmMg==} + validator@13.15.23: + resolution: {integrity: sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==} engines: {node: '>= 0.10'} vary@1.1.2: @@ -6965,10 +6965,10 @@ snapshots: dependencies: express: 5.2.1 - express-validator@7.2.1: + express-validator@7.3.1: dependencies: lodash: 4.17.21 - validator: 13.12.0 + validator: 13.15.23 express@4.22.0: dependencies: @@ -9024,7 +9024,7 @@ snapshots: '@types/istanbul-lib-coverage': 2.0.6 convert-source-map: 2.0.0 - validator@13.12.0: {} + validator@13.15.23: {} vary@1.1.2: {}