mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
b9077d96d8
* chore(deps): consolidate dependency and security bumps Dependabot PRs applied: - #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime) - #13013 alpine 3.24.1 -> 3.24.2 - #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml) - #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml) - #13075 simple-git 3.36.0 -> 4.0.1 (security) - #13076 katex 0.16.45 -> 0.18.2+ (security) - #13077 dompurify 3.4.13 -> 3.4.16 (security) - #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.) Skipped (already satisfied on master): #12513, #12624, #12625, #12633 Manual security bumps via pnpm.overrides (no dependabot PR existed): - axios -> 1.20.0 - smol-toml -> 1.9.0 - postcss -> 8.5.23 - postcss-selector-parser -> 7.1.6 - colord -> 2.9.4 - unhead -> 2.1.13 - markdown-it -> 14.3.1 - esbuild -> 0.28.1 - brace-expansion 5.0.11 -> 5.0.12 Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is. go build and pnpm install verified clean. * chore(deps): fix residual transitive vulns found by trivy trivy flagged duplicate/stale resolutions that survived the earlier override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0), and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides accordingly. trivy fs scan of web/pnpm-lock.yaml now clean. * chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a, pulling in its go-playground/locales and huandu/xstrings version bumps. Appends this PR to changelog/unreleased/bump-reva.md. go build ./... verified clean after go mod vendor resync. * fix(ci): revert unhead override, breaks web build * revert: keep k8s.yml actions/checkout and setup-node pinned