23bf204ae7
Pulls fixes for the cluster of advisories filed against 1.15.0: prototype-pollution gadgets in resolveConfig/mergeConfig, CRLF injection in headers and multipart bodies, no_proxy bypass via RFC 1122 loopback subnet and IP aliases, parseReviver tampering, withXSRFToken cross-origin leakage, validateStatus auth bypass, and AxiosURLSearchParams null-byte injection. Addressed across axios 1.15.1, 1.15.2, and 1.16.0. axios is only present as a transitive peer dep (ibm-cloud-sdk-core); the override forces a single 1.16.0 resolution. Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
48 lines
1.1 KiB
JSON
48 lines
1.1 KiB
JSON
{
|
|
"name": "probo",
|
|
"description": "Probo monorepo containing applications and shared packages",
|
|
"engines": {
|
|
"node": "^24.0.0",
|
|
"npm": "^11.8.0"
|
|
},
|
|
"workspaces": [
|
|
"apps/*",
|
|
"packages/*"
|
|
],
|
|
"scripts": {
|
|
"build": "turbo run build",
|
|
"dev": "turbo run dev",
|
|
"lint": "turbo run lint",
|
|
"check": "turbo run check",
|
|
"relay-clean": "find apps -type d -name __generated__ -exec rm -rf {} +",
|
|
"relay-compile": "npx relay-compiler",
|
|
"relay": "npm run relay-clean && npm run relay-compile"
|
|
},
|
|
"devDependencies": {
|
|
"relay-compiler": "^20.1.1",
|
|
"turbo": "^2.5.3"
|
|
},
|
|
"graphql": {
|
|
"schema": "./pkg/server/api/console/v1/graphql/"
|
|
},
|
|
"overrides": {
|
|
"brace-expansion": "^5.0.5",
|
|
"minimatch@3": {
|
|
"brace-expansion": "^1.1.11"
|
|
},
|
|
"minimatch@9": "^9.0.9",
|
|
"@langchain/classic": "^1.0.27",
|
|
"langsmith": "^0.5.19",
|
|
"handlebars": "4.7.9",
|
|
"@langchain/community": "^1.1.25",
|
|
"lodash": "^4.18.1",
|
|
"lodash-es": "^4.18.1",
|
|
"axios": "^1.16.0"
|
|
},
|
|
"license": "MIT",
|
|
"packageManager": "npm@11.8.0",
|
|
"dependencies": {
|
|
"react-dom": "^19.2.1"
|
|
}
|
|
}
|