Fix npm audit vulnerabilities

Bump @n8n/node-cli to ^0.24.1 and remove stale form-data override.

Add overrides for transitive sub-dependencies with no upstream fix:
- brace-expansion ^5.0.5 (ReDoS / process hang)
- minimatch@9 ^9.0.9 (ReDoS in 9.0.0-9.0.6)
- langsmith ^0.5.0 (SSRF via tracing header injection)
- handlebars 4.7.9 (prototype pollution / XSS)
- @langchain/community ^1.1.25 (SSRF bypass)

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-03-27 11:07:33 +01:00
parent cd62af88a3
commit a8f733706b
3 changed files with 1436 additions and 1850 deletions

3274
package-lock.json generated

File diff suppressed because it is too large Load Diff

View File

@@ -23,11 +23,11 @@
"schema": "./pkg/server/api/console/v1/schema.graphql"
},
"overrides": {
"form-data": "^4.0.4",
"minimatch": "^9.0.9",
"@typescript-eslint/typescript-estree": {
"minimatch": "^9.0.9"
}
"brace-expansion": "^5.0.5",
"minimatch@9": "^9.0.9",
"langsmith": "^0.5.0",
"handlebars": "4.7.9",
"@langchain/community": "^1.1.25"
},
"license": "MIT",
"packageManager": "npm@11.8.0",

View File

@@ -55,7 +55,7 @@
"n8n-workflow": "*"
},
"devDependencies": {
"@n8n/node-cli": "^0.23.1",
"@n8n/node-cli": "^0.24.1",
"eslint": "^9.39.2"
}
}