Fix npm audit vulnerabilities

Bump @n8n/node-cli to ^0.24.1 and remove stale form-data override.

Add overrides for transitive sub-dependencies with no upstream fix:
- brace-expansion ^5.0.5 (ReDoS / process hang)
- minimatch@9 ^9.0.9 (ReDoS in 9.0.0-9.0.6)
- langsmith ^0.5.0 (SSRF via tracing header injection)
- handlebars 4.7.9 (prototype pollution / XSS)
- @langchain/community ^1.1.25 (SSRF bypass)

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-03-27 11:07:33 +01:00
parent cd62af88a3
commit a8f733706b
3 changed files with 1436 additions and 1850 deletions

3274
package-lock.json generated

File diff suppressed because it is too large Load Diff

View File

@@ -23,11 +23,11 @@
"schema": "./pkg/server/api/console/v1/schema.graphql" "schema": "./pkg/server/api/console/v1/schema.graphql"
}, },
"overrides": { "overrides": {
"form-data": "^4.0.4", "brace-expansion": "^5.0.5",
"minimatch": "^9.0.9", "minimatch@9": "^9.0.9",
"@typescript-eslint/typescript-estree": { "langsmith": "^0.5.0",
"minimatch": "^9.0.9" "handlebars": "4.7.9",
} "@langchain/community": "^1.1.25"
}, },
"license": "MIT", "license": "MIT",
"packageManager": "npm@11.8.0", "packageManager": "npm@11.8.0",

View File

@@ -55,7 +55,7 @@
"n8n-workflow": "*" "n8n-workflow": "*"
}, },
"devDependencies": { "devDependencies": {
"@n8n/node-cli": "^0.23.1", "@n8n/node-cli": "^0.24.1",
"eslint": "^9.39.2" "eslint": "^9.39.2"
} }
} }