[pull] main from tinacms:main - #307
Merged
Merged
Conversation
Closes #7441 **TL;DR** One line in `pnpm-workspace.yaml` collapses four vulnerable `qs` copies into one patched version, and unblocks three Dependabot PRs as a side effect. **Pain:** The lockfile carried four separate `qs` copies (6.5.3, 6.5.5, 6.11.0, 6.14.0), every one below the 6.14.1 patch line for GHSA-6rw7-vpxm-498p, with two further advisories applying up to 6.15.2. `main` looked green only because `dependency-review` reports what a diff introduces rather than what is already present, so the problem stayed invisible until Dependabot regenerated some lockfiles and pulled qs 6.5.3 up to 6.5.5. Three unrelated PRs (#7425, #7421, #7321) then failed the same check for a vulnerability that had been on `main` all along. The tempting fix, pinning qs back to 6.5.3, would turn the check green while fixing nothing, because 6.5.3 is equally affected. **Solution:** Added `qs: ^6.15.2` to the existing `overrides:` block, which collapses all four copies to a single 6.15.3, past the patch line for all three open advisories. The affected chain is test-only (`vitest@0.32.4` to `jsdom@15.2.1` to `request-promise-native` to `request` to `qs`), so nothing user-facing changes. Retiring `vitest@0.32.4` and the deprecated `request` chain is the real fix and is tracked separately on #7441. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Bumps [next-auth](https://github.com/nextauthjs/next-auth) from 4.24.13 to 4.24.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nextauthjs/next-auth/releases">next-auth's releases</a>.</em></p> <blockquote> <h2>next-auth@4.24.15</h2> <p>Security patch release for the 4.x line.</p> <ul> <li><code>getToken()</code> now returns <code>null</code> instead of throwing when the <code>Authorization</code> header contains a malformed Bearer value.</li> <li>OAuth <code>state</code>, <code>nonce</code>, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.</li> <li>Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph <code>@</code> bypass.</li> <li>An explicitly configured <code>NEXTAUTH_URL</code> now takes precedence over the auto-detected forwarded host in trusted-host mode.</li> <li>Restores CommonJS compatibility by pinning <code>uuid</code> to <code>^11.1.1</code>; the 14.x line is ESM-only and broke <code>require()</code> on Node versions below 20.19.</li> </ul> <h2>next-auth@4.24.14</h2> <h2>Bugfixes</h2> <ul> <li><strong>providers</strong>: add issuer to GitHub provider for <a href="https://datatracker.ietf.org/doc/html/rfc9207">RFC 9207</a> compliance (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13412">#13412</a>)</li> </ul> <p>GitHub now returns an <code>iss</code> parameter in OAuth callbacks. <code>openid-client</code> validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to <code>https://github.com/login/oauth</code>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nextauthjs/next-auth/commit/d857eec560fb99c8b18d3b22a2693b849a62d1c3"><code>d857eec</code></a> chore(release): next-auth@4.24.15 [skip ci]</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"><code>5bca239</code></a> fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/db7e27de64fd7ffb97d4d04f602014954d685991"><code>db7e27d</code></a> chore(deps): use uuid ^11.1.1 to keep CommonJS support (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13466">#13466</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/32d874c15305adaf03edfdf0ffce5af88fc8c76d"><code>32d874c</code></a> fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13447">#13447</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/fa858580cd110256f5830515c027ada6dd769bd5"><code>fa85858</code></a> chore: update uuid to v14, remove deprecated types (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13422">#13422</a>)</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/2a39465620081987179ef435be91a6e2a68ee44f"><code>2a39465</code></a> Merge commit from fork</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"><code>19d2feb</code></a> Merge commit from fork</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/e9a892a069859b5170c0955e3e90bb16f89d35ad"><code>e9a892a</code></a> chore(release): bump version [skip ci]</li> <li><a href="https://github.com/nextauthjs/next-auth/commit/0497da43b973dd870f9f3bcd20f5604daa4b1ac8"><code>0497da4</code></a> fix(providers): add issuer to github (<a href="https://redirect.github.com/nextauthjs/next-auth/issues/13412">#13412</a>)</li> <li>See full diff in <a href="https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.13...next-auth@4.24.15">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~better-gustavo">better-gustavo</a>, a new releaser for next-auth since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy <kulewidak@gmail.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.2 to 3.15.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>3.15.1 - 2026-07-31</h2> <h3>Security</h3> <ul> <li>[backport] Remove quadratic complexity from <code>!!omap</code> duplicate key detection.</li> </ul> <h2>3.15.0 - 2026-06-27</h2> <h3>Added</h3> <ul> <li>Added <code>maxTotalMergeKeys</code> (10000) loader option to limit the total number of keys processed by YAML merge (<code><<</code>) across one <code>safeLoad()</code> / <code>safeLoadAll()</code> call.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/ab85ae2c622bc6d8cdbceccafe9f9b7df80463ed"><code>ab85ae2</code></a> 3.15.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/30a5e7647a4454f7bac969bfbbe7eac9921a4279"><code>30a5e76</code></a> dist rebuild</li> <li><a href="https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded"><code>22a8071</code></a> Backport quadratic complexity fix for !!omap</li> <li><a href="https://github.com/nodeca/js-yaml/commit/c34b6c40027a769eb0d67958ae615268a1d55f54"><code>c34b6c4</code></a> 3.15.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/21e13d363f33501c7ee6ca988b88c29084999f72"><code>21e13d3</code></a> dist rebuild</li> <li><a href="https://github.com/nodeca/js-yaml/commit/4165c62630d64fe4f25fb0d03139c7e137b24b1c"><code>4165c62</code></a> Add v3-legacy tag for publish</li> <li><a href="https://github.com/nodeca/js-yaml/commit/d8ff750b0130e4e4b4062fb0dbd32027e41d4c51"><code>d8ff750</code></a> Add package lock</li> <li><a href="https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"><code>24f13e7</code></a> Added <code>maxTotalMergeKeys</code> (10000) loader option (v5 backport)</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/3.14.2...3.15.1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy <kulewidak@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )