4-growth/pnpm-workspace.yaml at dev · Vizzuality/4-growth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
packages:
  - "api/**"
  - "client/**"
  - "shared/**"
  - "e2e/**"

onlyBuiltDependencies:
  - "@nestjs/core"

overrides:
  # d3-color ReDoS GHSA-36jr-mh4h-2g58 — patched >=3.1.0. Blanket is required: the
  # react-simple-maps tree pulls d3-interpolate 2.0.1, which declares `1 - 2` and so
  # resolves the vulnerable 2.0.0 unless every consumer is forced past the range.
  d3-color: 3.1.0
  # nestjs-base-service ships outdated transitive deps; scope overrides to that parent
  "nestjs-base-service>express": "4.22.2"
  "nestjs-base-service>lodash": "4.18.1"
  # Not a security fix. nestjs-base-service pins class-validator 0.14.0 exactly, and a
  # second copy in the tree gets its own MetadataStorage singleton — decorators applied
  # to shared/ DTOs become invisible to validate(), which then passes silently.
  "nestjs-base-service>class-validator": "0.14.4"
  # @aws-sdk/xml-builder ships vulnerable fast-xml-parser <5.7.0 (GHSA-8gc5-j5rx-235r)
  # 5.8.0 also pulls fast-xml-builder >=1.2.0 fixing GHSA-5wm8-gmm8-39j9
  "@aws-sdk/xml-builder>fast-xml-parser": "5.8.0"
  # next bundles postcss <8.5.18 (GHSA-r28c-9q8g-f849 — path traversal via sourceMappingURL disclosing arbitrary .map files)
  "next>postcss": "8.5.23"
  # @nestjs/platform-express pins multer 2.1.1 exactly; <2.3.0 allows DoS via crafted
  # multipart field names, oversized array indexes, and a file descriptor leak on aborted
  # uploads (GHSA-wc9g-mqfw-jrwm, GHSA-535w-7cp7-47q4, GHSA-qfvm-cv95-jqjf, GHSA-qvfw-j98x-7q72)
  "@nestjs/platform-express>multer": "2.3.0"
  # ajv declares fast-uri ^3.0.1 but the lockfile holds 3.1.5 — SSRF via malformed IPv6
  # normalization and repeated hostname percent-decoding, plus host confusion via
  # percent-encoded scheme normalization and skipped IDN canonicalization on
  # scheme-relative references (GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf,
  # GHSA-jqff-g426-hqxp, GHSA-5jgf-p345-68v8). Patched >=3.1.6.
  "ajv>fast-uri": "3.1.7"
  # browserslist <=4.28.6 crashes or writes to a prototype on untrusted custom stats in
  # normalizeStats, and never evicts its query cache, so memory grows until the process
  # dies (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx). Patched >=4.28.7. Blanket because all
  # four consumers sit on the 4.x line and accept 4.28.9 — @babel/helper-compilation-targets
  # (^4.24.0), autoprefixer (^4.23.0), update-browserslist-db (>=4.21.0), webpack (^4.28.1).
  browserslist: 4.28.9
  # js-yaml's maxTotalMergeKeys does not cap CPU use when merge sources are empty, so a
  # crafted document stalls the parser (GHSA-2883-xcg3-v3hh). Both major lines in the tree
  # are affected; patched at 3.15.2 and 4.3.2. Scoped to the single consumer of each.
  "@istanbuljs/load-nyc-config>js-yaml": "3.15.2"
  "cosmiconfig>js-yaml": "4.3.2"
  # @humanfs/node <0.16.8 follows symlinked files during a recursive copy, so it copies
  # data from outside the source tree (GHSA-p498-v437-472g). eslint declares ^0.16.6.
  "eslint>@humanfs/node": "0.16.8"
  # supertest > superagent resolves qs 6.15.2 — DoS via an attacker-controlled isBuffer and
  # an array-limit bypass through bracket keys containing commas (GHSA-4mjr-xmp4-gh2g,
  # GHSA-x5fp-wj9c-mxmx). superagent declares ^6.14.1. Scoped to superagent: the other qs
  # 6.15.2 copy sits under express 4.22.2, which pins ~6.15.1 deliberately.
  "superagent>qs": "6.16.0"
  # express 5.2.1 serves the api and resolves qs 6.15.2 for req.query parsing. Version-scoped
  # so express 4.22.2 under nestjs-base-service keeps 6.15.2, which is all its ~6.15.1 pin
  # allows (GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx). express 5 declares ^6.14.0.
  "express@5>qs": "6.16.0"

catalog:
  # Core
  zod: 3.25.76
  "@types/node": 25.3.0
  typescript: 5.9.3
  typeorm: 0.3.31
  bcrypt: 6.0.0
  "@types/bcrypt": 6.0.0
  # Linting & formatting
  eslint: 10.2.0
  eslint-config-prettier: 10.1.8
  eslint-plugin-prettier: 5.5.5
  prettier: 3.8.1
  "@typescript-eslint/eslint-plugin": 8.56.1
  "@typescript-eslint/parser": 8.56.1
  # Testing
  "@types/jest": 30.0.0
  # Tooling
  ts-node: 10.9.2
  # Shared libraries
  "@types/lodash": 4.17.24
  lodash: 4.18.1
  qs: 6.16.0
  "@types/qs": 6.14.0
  class-transformer: 0.5.1
  class-validator: 0.14.4