From f77ddf489050b339faa978bb28da954bafd289ae Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Fri, 24 Jul 2026 07:42:55 +0100 Subject: [PATCH 1/6] Fix pretty recipe parser ReDoS (#2687) Co-authored-by: zainnadeem(RedOpsCell) (main author) --- src/core/Utils.mjs | 48 ++++++++++++++++++++++++ tests/node/tests/Utils.mjs | 77 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 125 insertions(+) diff --git a/src/core/Utils.mjs b/src/core/Utils.mjs index eae86374b4..cb641e3dd3 100755 --- a/src/core/Utils.mjs +++ b/src/core/Utils.mjs @@ -1015,6 +1015,7 @@ class Utils { // Parse bespoke recipe format recipe = recipe.replace(/\n/g, ""); + Utils._validatePrettyRecipe(recipe); let m, args; const recipeRegex = /([^(]+)\(((?:'[^'\\]*(?:\\.[^'\\]*)*'|[^)/'])*)(\/[^)]+)?\)/g, recipeConfig = []; @@ -1040,6 +1041,53 @@ class Utils { } + /** + * Performs a linear structural validation pass over pretty recipe syntax. + * + * @param {string} recipe + * @throws {Error} if the recipe is structurally invalid + */ + static _validatePrettyRecipe(recipe) { + let i = 0; + + while (i < recipe.length) { + const openParen = recipe.indexOf("(", i); + if (openParen === -1 || openParen === i) { + throw new Error("Invalid recipe"); + } + + i = openParen + 1; + let inString = false, + escaped = false, + foundCloseParen = false; + + for (; i < recipe.length; i++) { + const c = recipe[i]; + + if (inString) { + if (escaped) { + escaped = false; + } else if (c === "\\") { + escaped = true; + } else if (c === "'") { + inString = false; + } + } else if (c === "'") { + inString = true; + } else if (c === ")") { + foundCloseParen = true; + i++; + break; + } + } + + if (!foundCloseParen || inString || escaped) { + throw new Error("Invalid recipe"); + } + } + } + + /** * Formats a list of files or directories. * diff --git a/tests/node/tests/Utils.mjs b/tests/node/tests/Utils.mjs index 5ee7c9362e..ff4ffd96b9 100644 --- a/tests/node/tests/Utils.mjs +++ b/tests/node/tests/Utils.mjs @@ -26,4 +26,81 @@ TestRegister.addApiTests([ "\x7e...", ); }), + + it("Utils: should parse normal pretty recipes", () => { + assert.deepStrictEqual( + Utils.parseRecipeConfig("From_Base64('A-Za-z0-9+/=',true)To_Hex('Space')"), + [ + { + op: "From Base64", + args: ["A-Za-z0-9+/=", true], + }, + { + op: "To Hex", + args: ["Space"], + }, + ], + ); + }), + + it("Utils: should parse pretty recipe options", () => { + assert.deepStrictEqual( + Utils.parseRecipeConfig("A(/disabled/breakpoint)"), + [ + { + op: "A", + args: [], + disabled: true, + breakpoint: true, + }, + ], + ); + }), + + it("Utils: should parse escaped quotes and backslashes in pretty recipes", () => { + assert.deepStrictEqual( + Utils.parseRecipeConfig("A('\\'\\\\')"), + [ + { + op: "A", + args: ["'\\"], + }, + ], + ); + }), + + it("Utils: should parse large valid quoted pretty recipe arguments", () => { + const value = "x".repeat(10000); + + assert.deepStrictEqual( + Utils.parseRecipeConfig(`A('${value}')`), + [ + { + op: "A", + args: [value], + }, + ], + ); + }), + + it("Utils: should reject malformed pretty recipes with unmatched quotes", () => { + assert.throws( + () => Utils.parseRecipeConfig("A(" + "'".repeat(10000)), + /Invalid recipe/, + ); + }), + + it("Utils: should reject malformed pretty recipes with malformed parentheses", () => { + assert.throws( + () => Utils.parseRecipeConfig("A("), + /Invalid recipe/, + ); + }), + + it("Utils: should reject malformed pretty recipes with malformed escapes", () => { + assert.throws( + () => Utils.parseRecipeConfig("A('" + "\\".repeat(10000)), + /Invalid recipe/, + ); + }), ]); From d24ba1afce2e3a080308b5df7db033332fe94a1a Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:05:09 +0100 Subject: [PATCH 2/6] Bump v11.3.0 (#2688) --- CHANGELOG.md | 148 +++++++++++++++++++++++++++++++++++++++++++++- package-lock.json | 4 +- package.json | 2 +- 3 files changed, 150 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 77a55714d5..7978671680 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,75 @@ All major and minor version changes will be documented in this file. Details of ## Details +### [11.3.0] - 2026-07-24 +This release includes a security fix ([#2687]) +- Security: Fix pretty recipe parser ReDoS [@zainnadeem786] | [#2687] +- feat: add modulo operation [@thomasnemer] [@GCHQDeveloper581] | [#2103] +- Add HMAC regression tests for Decimal key parsing [@alleria173] | [#2680] +- fix: await Node API operations whose run() returns a non-async Promise [@roberson-io] | [#2659] +- chore (deps): bump morgan from 1.10.1 to 1.11.0 | [#2676] +- fix: fromDecimal Auto delimiter now correctly parses multiple numbers [@min23asdw] | [#2270] +- Add Generate Prime Number operation [@p-leriche] | [#2212] +- Add Modular Inverse operation [@p-leriche] | [#2207] +- Consolidate HTML entity tables into a single spec-generated source (#2645) [@roberson-io] | [#2671] +- Add Extended GCD operation [@p-leriche] | [#2206] +- Add COBS encoding/decoding operations [@giesmininkas] | [#2185] +- chore (deps): bump websocket-driver from 0.7.4 to 0.7.5 | [#2673] +- fix: remove stray punctuation from malformed To HTML Entity table values [@roberson-io] | [#2660] +- chore (deps): bump the actions-dependencies group across 1 directory with 6 updates | [#2668] +- chore (deps): bump the minor-updates group across 1 directory with 3 updates | [#2669] +- chore (deps): bump the patch-updates group with 5 updates | [#2654] +- feat: add TEA and XTEA block ciphers [@thomasxm] | [#2225] +- feat: add PRESENT and Twofish ciphers [@thomasxm] | [#2157] +- fix: support constructor and __proto__ parameters in Parse URI (#2578) [@mansiverma897993] | [#2581] +- feat: Implement automated option-type ingredient validation [@mansiverma897993] | [#2625] +- Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt [@thomasxm] | [#2155] +- chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2638] +- chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group | [#2635] +- chore (deps): bump nginxinc/nginx-unprivileged from `458ecbe` to `fd3314e` in the docker-dependencies group | [#2633] +- Feature: automatically expire PRs if CLA remains unsigned for an extended period [@GCHQDeveloper581] | [#2636] +- fix/2445 HOTP (and 2426 TOTP) type errors [@alleria173] | [#2620] +- Fix base32 unicode alphabet [@loki1205] | [#2380] +- Add a workflow to automatically flag PRs without a signed CLA [@GCHQDeveloper581] | [#2627] +- fix/2444 TOTP input validation for correct otpauth uri generation [@alleria173] | [#2621] +- Validate Wrap line width [@vetrovk] [@GCHQDeveloper581] [@C85297] | [#2606] +- Handle malformed image parser errors in View Bit Plane [@zainnadeem786] | [#2612] +- Fixes #2446 hotp otpauth uri validation [@alleria173] | [#2614] +- Handle invalid bcrypt salt errors in Bcrypt compare [@zainnadeem786] | [#2615] +- Validate empty Show On Map options [@vetrovk] | [#2631] +- Create AGENTS.md file [@C85297] | [#2619] +- Set parameter validation Metadata for GenerateImage operations [@GCHQDeveloper581] | [#2611] +- Update 4 vulnerable dependencies [@GCHQDeveloper581] | [#2616] +- Fix BigNumber deserialisation in Dish, and add tests [@GCHQDeveloper581] | [#2607] +- chore (deps): bump the docker-dependencies group with 2 updates | [#2600] +- chore (deps): bump the patch-updates group with 8 updates | [#2602] +- chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group | [#2601] +- chore (deps): bump the minor-updates group with 2 updates | [#2603] +- Handle empty Generate Image mode [@vetrovk] | [#2598] +- Fix stale presenter after expected operation errors [@zainnadeem786] [@GCHQDeveloper581] | [#2589] +- Clean up/rationalise webpack paths and thereby increase compatibility for Win… [@GCHQDeveloper581] | [#2585] +- Improve parameter validation for a number of operations where exceptions otherwise caused. [@GCHQDeveloper581] | [#2586] +- Fix uncaught TypeError in "Show on map" operation. [@lzandman] | [#2453] +- fix: jsonata $base64decode/$base64encode in Web Worker [@min23asdw] | [#2275] +- fix Dechunk HTTP Response leaks terminating chunk and trailers into output [@williballenthin] | [#2290] +- fix: MIME Decoding corrupts non-ASCII characters in Base64-encoded words [@williballenthin] | [#2291] +- fix: Gzip comment with header checksum produces corrupt streams [@williballenthin] | [#2288] +- fix TLV Parser BER long-form length parsing [@williballenthin] | [#2289] +- fix: Unescape Unicode Characters accepts 4-6 hex digits for U+ prefix [@williballenthin] | [#2287] +- fix Set Difference and Set Intersection preserve duplicates from first sample [@williballenthin] | [#2286] +- fix: From Base operation produces wrong results for fractional inputs [@williballenthin] | [#2285] +- fix Median operation returns incorrect result for unsorted odd-length inputs [@williballenthin] | [#2284] +- Added RenderPDF functionality [@Shailendra1703] [@GCHQDeveloper581] | [#2105] +- Fix URL encoding incorrectly converting input to UTF-8 [@C85297] | [#2340] +- feat: Add automated parameter validation framework [@mansiverma897993] | [#2561] +- Fix: added viewport styles to img tag in RenderImage Dish [@Shailendra1703] [@C85297] | [#2109] +- chore (deps): bump form-data from 4.0.5 to 4.0.6 | [#2572] +- chore (deps): bump the patch-updates group with 5 updates [@GCHQDeveloper581] | [#2580] +- chore (deps): bump the docker-dependencies group with 2 updates | [#2579] +- Fix operation description rendering [@C85297] | [#2577] +- chore (deps): bump launch-editor from 2.13.1 to 2.14.1 | [#2574] +- chore (deps): bump dompurify from 3.4.8 to 3.4.9 | [#2573] + ### [11.2.0] - 2026-06-17 This release includes a security fix ([#2569]) - Security: Chart operation prototype protection [@C85297] | [#2569] @@ -718,6 +787,7 @@ Breaking changes: ## [4.0.0] - 2016-11-28 - Initial open source commit [@n1474335] | [b1d73a72](https://github.com/gchq/CyberChef/commit/b1d73a725dc7ab9fb7eb789296efd2b7e4b08306) +[11.3.0]: https://github.com/gchq/CyberChef/releases/tag/v11.3.0 [11.2.0]: https://github.com/gchq/CyberChef/releases/tag/v11.2.0 [11.1.0]: https://github.com/gchq/CyberChef/releases/tag/v11.1.0 [11.0.0]: https://github.com/gchq/CyberChef/releases/tag/v11.0.0 @@ -1018,6 +1088,17 @@ Breaking changes: [@qa2me]: https://github.com/qa2me [@heapframe]: https://github.com/heapframe [@skyswordw]: https://github.com/skyswordw +[@thomasnemer]: https://github.com/thomasnemer +[@alleria173]: https://github.com/alleria173 +[@roberson-io]: https://github.com/roberson-io +[@min23asdw]: https://github.com/min23asdw +[@giesmininkas]: https://github.com/giesmininkas +[@mansiverma897993]: https://github.com/mansiverma897993 +[@loki1205]: https://github.com/loki1205 +[@vetrovk]: https://github.com/vetrovk +[@zainnadeem786]: https://github.com/zainnadeem786 +[@williballenthin]: https://github.com/williballenthin +[@Shailendra1703]: https://github.com/Shailendra1703 [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7 @@ -1389,4 +1470,69 @@ Breaking changes: [#2404]: https://github.com/gchq/CyberChef/pull/2404 [#2458]: https://github.com/gchq/CyberChef/pull/2458 [#2514]: https://github.com/gchq/CyberChef/pull/2514 - +[#2687]: https://github.com/gchq/CyberChef/pull/2687 +[#2103]: https://github.com/gchq/CyberChef/pull/2103 +[#2680]: https://github.com/gchq/CyberChef/pull/2680 +[#2659]: https://github.com/gchq/CyberChef/pull/2659 +[#2676]: https://github.com/gchq/CyberChef/pull/2676 +[#2270]: https://github.com/gchq/CyberChef/pull/2270 +[#2212]: https://github.com/gchq/CyberChef/pull/2212 +[#2207]: https://github.com/gchq/CyberChef/pull/2207 +[#2671]: https://github.com/gchq/CyberChef/pull/2671 +[#2206]: https://github.com/gchq/CyberChef/pull/2206 +[#2185]: https://github.com/gchq/CyberChef/pull/2185 +[#2673]: https://github.com/gchq/CyberChef/pull/2673 +[#2660]: https://github.com/gchq/CyberChef/pull/2660 +[#2668]: https://github.com/gchq/CyberChef/pull/2668 +[#2669]: https://github.com/gchq/CyberChef/pull/2669 +[#2654]: https://github.com/gchq/CyberChef/pull/2654 +[#2225]: https://github.com/gchq/CyberChef/pull/2225 +[#2157]: https://github.com/gchq/CyberChef/pull/2157 +[#2581]: https://github.com/gchq/CyberChef/pull/2581 +[#2625]: https://github.com/gchq/CyberChef/pull/2625 +[#2155]: https://github.com/gchq/CyberChef/pull/2155 +[#2638]: https://github.com/gchq/CyberChef/pull/2638 +[#2635]: https://github.com/gchq/CyberChef/pull/2635 +[#2633]: https://github.com/gchq/CyberChef/pull/2633 +[#2636]: https://github.com/gchq/CyberChef/pull/2636 +[#2620]: https://github.com/gchq/CyberChef/pull/2620 +[#2380]: https://github.com/gchq/CyberChef/pull/2380 +[#2627]: https://github.com/gchq/CyberChef/pull/2627 +[#2621]: https://github.com/gchq/CyberChef/pull/2621 +[#2606]: https://github.com/gchq/CyberChef/pull/2606 +[#2612]: https://github.com/gchq/CyberChef/pull/2612 +[#2614]: https://github.com/gchq/CyberChef/pull/2614 +[#2615]: https://github.com/gchq/CyberChef/pull/2615 +[#2631]: https://github.com/gchq/CyberChef/pull/2631 +[#2619]: https://github.com/gchq/CyberChef/pull/2619 +[#2611]: https://github.com/gchq/CyberChef/pull/2611 +[#2616]: https://github.com/gchq/CyberChef/pull/2616 +[#2607]: https://github.com/gchq/CyberChef/pull/2607 +[#2600]: https://github.com/gchq/CyberChef/pull/2600 +[#2602]: https://github.com/gchq/CyberChef/pull/2602 +[#2601]: https://github.com/gchq/CyberChef/pull/2601 +[#2603]: https://github.com/gchq/CyberChef/pull/2603 +[#2598]: https://github.com/gchq/CyberChef/pull/2598 +[#2589]: https://github.com/gchq/CyberChef/pull/2589 +[#2585]: https://github.com/gchq/CyberChef/pull/2585 +[#2586]: https://github.com/gchq/CyberChef/pull/2586 +[#2453]: https://github.com/gchq/CyberChef/pull/2453 +[#2275]: https://github.com/gchq/CyberChef/pull/2275 +[#2290]: https://github.com/gchq/CyberChef/pull/2290 +[#2291]: https://github.com/gchq/CyberChef/pull/2291 +[#2288]: https://github.com/gchq/CyberChef/pull/2288 +[#2289]: https://github.com/gchq/CyberChef/pull/2289 +[#2287]: https://github.com/gchq/CyberChef/pull/2287 +[#2286]: https://github.com/gchq/CyberChef/pull/2286 +[#2285]: https://github.com/gchq/CyberChef/pull/2285 +[#2284]: https://github.com/gchq/CyberChef/pull/2284 +[#2105]: https://github.com/gchq/CyberChef/pull/2105 +[#2340]: https://github.com/gchq/CyberChef/pull/2340 +[#2561]: https://github.com/gchq/CyberChef/pull/2561 +[#2109]: https://github.com/gchq/CyberChef/pull/2109 +[#2572]: https://github.com/gchq/CyberChef/pull/2572 +[#2580]: https://github.com/gchq/CyberChef/pull/2580 +[#2579]: https://github.com/gchq/CyberChef/pull/2579 +[#2577]: https://github.com/gchq/CyberChef/pull/2577 +[#2574]: https://github.com/gchq/CyberChef/pull/2574 +[#2573]: https://github.com/gchq/CyberChef/pull/2573 diff --git a/package-lock.json b/package-lock.json index a8068e3fd9..1ea35a5649 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cyberchef", - "version": "11.2.0", + "version": "11.3.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cyberchef", - "version": "11.2.0", + "version": "11.3.0", "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { diff --git a/package.json b/package.json index 8512412bbf..c4f9a7fbe6 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cyberchef", - "version": "11.2.0", + "version": "11.3.0", "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.", "author": "GCHQ ", "homepage": "https://gchq.github.io/CyberChef", From 4b43f89eb8aace40da2693caac5e64ea9223a27a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:38:40 +0100 Subject: [PATCH 3/6] chore (deps): bump nginxinc/nginx-unprivileged from `fd3314e` to `44e3633` in the docker-dependencies group (#2684) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 564e8d6669..e7076f4278 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:fd3314e343bad2de4e1127ef58be122abbfa7e09572fa46ae62fcddb6b3f21c5 AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:44e36330f74d4f3a1d4e222acca9e23b401fb87811a7597024502bb759c4dd49 AS cyberchef LABEL maintainer="GCHQ " From 51600c4a4f2130581870d94c71bdc63c40b06996 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:49:31 +0100 Subject: [PATCH 4/6] chore (deps): bump the actions-dependencies group across 1 directory with 2 updates (#2685) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/master.yml | 4 ++-- .github/workflows/pull_requests.yml | 4 ++-- .github/workflows/releases.yml | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index e8a120ede6..f3c6f711dd 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,10 +16,10 @@ jobs: pages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set node version - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index aee3d22a65..5ee2708650 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -12,10 +12,10 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set node version - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index ae92cdf9f9..81e1ae1c43 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -22,10 +22,10 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set node version - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" @@ -110,10 +110,10 @@ jobs: needs: main runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set node version - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 registry-url: "https://registry.npmjs.org" From ed21930260c10cd6d89bbfd0532d5fe46bd83647 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:04:47 +0100 Subject: [PATCH 5/6] chore (deps): bump the patch-updates group across 1 directory with 9 updates (#2686) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 140 +++++++++++++++++++++++----------------------- package.json | 18 +++--- 2 files changed, 79 insertions(+), 79 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1ea35a5649..19b8d15b86 100644 --- a/package-lock.json +++ b/package-lock.json @@ -39,7 +39,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.11", + "dompurify": "^3.4.12", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -59,7 +59,7 @@ "js-sha3": "^0.9.3", "jsesc": "^3.1.0", "json5": "^2.2.3", - "jsonata": "^2.2.1", + "jsonata": "^2.2.2", "jsonpath-plus": "^10.4.0", "jsonwebtoken": "9.0.3", "jsqr": "^1.4.0", @@ -74,7 +74,7 @@ "lz4js": "^0.2.0", "markdown-it": "^14.3.0", "moment": "^2.30.1", - "moment-timezone": "^0.6.2", + "moment-timezone": "^0.6.3", "ngeohash": "^0.6.3", "node-forge": "^1.4.0", "node-md6": "^0.1.0", @@ -86,7 +86,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.7.0", + "protobufjs": "^8.7.1", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -121,10 +121,10 @@ "@codemirror/state": "^6.7.1", "@codemirror/view": "^6.43.6", "@puppeteer/browsers": "3.0.6", - "autoprefixer": "^10.5.2", + "autoprefixer": "^10.5.4", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", - "chromedriver": "^150.0.3", + "chromedriver": "^150.0.4", "cli-progress": "^3.12.0", "colors": "^1.4.0", "compression-webpack-plugin": "^12.0.0", @@ -132,7 +132,7 @@ "core-js": "^3.49.0", "cspell": "^10.0.1", "css-loader": "^7.1.4", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-plugin-jsdoc": "^50.8.0", "globals": "^17.7.0", "grunt": "^1.6.2", @@ -151,7 +151,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.16", + "postcss": "^8.5.21", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.1.1", "postcss-loader": "^8.2.1", @@ -159,7 +159,7 @@ "sitemap": "^9.0.1", "terser": "^5.49.0", "webpack": "^5.108.4", - "webpack-bundle-analyzer": "^5.3.0", + "webpack-bundle-analyzer": "^5.3.1", "webpack-dev-server": "^5.2.6", "webpack-node-externals": "^3.0.0", "worker-loader": "^3.0.8" @@ -2776,9 +2776,9 @@ } }, "node_modules/@eslint/eslintrc": { - "version": "3.3.5", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz", - "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==", + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", "dev": true, "license": "MIT", "dependencies": { @@ -2788,7 +2788,7 @@ "globals": "^14.0.0", "ignore": "^5.2.0", "import-fresh": "^3.2.1", - "js-yaml": "^4.1.1", + "js-yaml": "^4.3.0", "minimatch": "^3.1.5", "strip-json-comments": "^3.1.1" }, @@ -2813,9 +2813,9 @@ } }, "node_modules/@eslint/js": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", - "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz", + "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==", "dev": true, "license": "MIT", "engines": { @@ -5620,9 +5620,9 @@ "license": "MIT" }, "node_modules/autoprefixer": { - "version": "10.5.2", - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz", - "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==", + "version": "10.5.4", + "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.4.tgz", + "integrity": "sha512-MaU0U/za7N3r6brxD4YB/l4NSrFzLPlANv6wEuQVaIPlD3L4W9rFcQPbL/EilY9BHhHvhfcz3gInDLrEtWT4EA==", "dev": true, "funding": [ { @@ -5640,8 +5640,8 @@ ], "license": "MIT", "dependencies": { - "browserslist": "^4.28.4", - "caniuse-lite": "^1.0.30001799", + "browserslist": "^4.28.6", + "caniuse-lite": "^1.0.30001806", "fraction.js": "^5.3.4", "picocolors": "^1.1.1", "postcss-value-parser": "^4.2.0" @@ -5842,9 +5842,9 @@ "license": "MIT" }, "node_modules/baseline-browser-mapping": { - "version": "2.10.40", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz", - "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==", + "version": "2.11.1", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.1.tgz", + "integrity": "sha512-HYXq73DDpCtNzOmrFsm9eSwCvWCql0RzqjpDzXN9EadiLJ4DNat0nsZ/Bzmy+Ud12mb4/zKDY0cQ805ZzN+i0A==", "dev": true, "license": "Apache-2.0", "bin": { @@ -6376,9 +6376,9 @@ } }, "node_modules/browserslist": { - "version": "4.28.4", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz", - "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==", + "version": "4.28.7", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz", + "integrity": "sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==", "dev": true, "funding": [ { @@ -6396,10 +6396,10 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.38", - "caniuse-lite": "^1.0.30001799", - "electron-to-chromium": "^1.5.376", - "node-releases": "^2.0.48", + "baseline-browser-mapping": "^2.10.44", + "caniuse-lite": "^1.0.30001806", + "electron-to-chromium": "^1.5.393", + "node-releases": "^2.0.51", "update-browserslist-db": "^1.2.3" }, "bin": { @@ -6591,9 +6591,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001799", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz", - "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==", + "version": "1.0.30001806", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz", + "integrity": "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==", "dev": true, "funding": [ { @@ -6733,9 +6733,9 @@ } }, "node_modules/chromedriver": { - "version": "150.0.3", - "resolved": "https://registry.npmjs.org/chromedriver/-/chromedriver-150.0.3.tgz", - "integrity": "sha512-i2L979d6YDTVVUDUPWXz75HGKKVhjNXo74gLiy/f8Adb5zHLU+h3ABdg8RRoiegtjJB0m9vUEiPTdecD0ifa3w==", + "version": "150.0.4", + "resolved": "https://registry.npmjs.org/chromedriver/-/chromedriver-150.0.4.tgz", + "integrity": "sha512-Yg2oXBONi1mqAMOG2ybwUneSvxIn04NF4qNAJ+yGO2H7WwX1WYLGQRHVHsbySEjIuqIyDmS1ZfAw6p0wtl43zQ==", "dev": true, "hasInstallScript": true, "license": "Apache-2.0", @@ -8702,9 +8702,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.11", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz", - "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -8809,9 +8809,9 @@ } }, "node_modules/electron-to-chromium": { - "version": "1.5.379", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.379.tgz", - "integrity": "sha512-v/qV5aV5EUA2pGilzUCq5/eyOloZAqDZBu9UMBIzgPpLlprjSR6zswsWBTv0KpqxLGUAZEwhO95ZCt7srymNVA==", + "version": "1.5.396", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.396.tgz", + "integrity": "sha512-yHiw2Y3C3H9U6TMbOfoWK/BPreiOPXRfTWPBwQBoZG6/8TB6eOPnsy5oaRYuatR7Fw2SJ4kKforgufeo7fq0EQ==", "dev": true, "license": "ISC" }, @@ -9112,9 +9112,9 @@ } }, "node_modules/eslint": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz", - "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz", + "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==", "dev": true, "license": "MIT", "dependencies": { @@ -9123,8 +9123,8 @@ "@eslint/config-array": "^0.21.2", "@eslint/config-helpers": "^0.4.2", "@eslint/core": "^0.17.0", - "@eslint/eslintrc": "^3.3.5", - "@eslint/js": "9.39.4", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "9.39.5", "@eslint/plugin-kit": "^0.4.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", @@ -12535,9 +12535,9 @@ } }, "node_modules/jsonata": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/jsonata/-/jsonata-2.2.1.tgz", - "integrity": "sha512-xd1uwUrKeIcJbsWhaoS3qAX4Ea8m0Mw0G5nlnAQvPT7TbZ5qaPdzBVTQia9KfyuyQm+nenfyjvzUDTRYHsC2sw==", + "version": "2.2.2", + "resolved": "https://registry.npmjs.org/jsonata/-/jsonata-2.2.2.tgz", + "integrity": "sha512-XDFH2PuaAXv0AXJEWwElXbqADmKFGKMLMkFb+qOz0EhjQW2EIJ6pgtordLU+4u3IVERyBfqy6bi6kZKEncvRqA==", "license": "MIT", "engines": { "node": ">= 8" @@ -13584,9 +13584,9 @@ } }, "node_modules/moment-timezone": { - "version": "0.6.2", - "resolved": "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.6.2.tgz", - "integrity": "sha512-lDsQv8FoGdBUdf0+TjGsq2orxKuXdwFlQ6Zw6TX3xIcTwTfEpCLyKqvEauvCHJ8iu3KBV8+uPhlv70YsNGdUBQ==", + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.6.3.tgz", + "integrity": "sha512-pVEPA/HCFHHbwJ130ywnzYuZpkEGcP6Daa/OwNebpA18MybeFHmQilAGGovXgWijQ8vQtmud9jZrziUBgsykfg==", "license": "MIT", "dependencies": { "moment": "^2.29.4" @@ -13698,9 +13698,9 @@ "license": "ISC" }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "dev": true, "funding": [ { @@ -14033,9 +14033,9 @@ "license": "CC0-1.0" }, "node_modules/node-releases": { - "version": "2.0.50", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz", - "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==", + "version": "2.0.51", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz", + "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==", "dev": true, "license": "MIT", "engines": { @@ -15041,9 +15041,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.21", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.21.tgz", + "integrity": "sha512-v4sDNP3fdNiWMfabO7OwOQdOX8TiQSztKyT1Wj0w+j7LDallJThJRBBBmzVGyYj0crMh7jlV4zepPkiNu9UwDQ==", "dev": true, "funding": [ { @@ -15061,7 +15061,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -15310,9 +15310,9 @@ "license": "MIT" }, "node_modules/protobufjs": { - "version": "8.7.0", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.7.0.tgz", - "integrity": "sha512-uu52JNxLh3vsL7tXU/h0gDaywufvuUCTbGSi0NKQKBZ2ZopkmrWQJSQO/EFqzu/5YhiwgVM8rq/a/iVpx4eZ0g==", + "version": "8.7.1", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.7.1.tgz", + "integrity": "sha512-agdGHrXNTv0IrYscJPDou/PlEJk1c/hBZ9o/B5NH2i/nSPtPqacNxzgwf1CebXxFMjMrZH5sqv9uQuw96aGt/A==", "license": "BSD-3-Clause", "dependencies": { "long": "^5.3.2" @@ -18212,9 +18212,9 @@ } }, "node_modules/webpack-bundle-analyzer": { - "version": "5.3.0", - "resolved": "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-5.3.0.tgz", - "integrity": "sha512-PEhAoqiJ+47d0uLMx/+zo5XOvaU+Vk6N2ZLht7H3n09QLy/fhyvqGNwjdRUHJDgMN8crBR2ZwVHkIswT3Xuawg==", + "version": "5.3.1", + "resolved": "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-5.3.1.tgz", + "integrity": "sha512-wP2EusncRGL1tZyMHC/umLkjPdYMkTL9nPEKh8G8dkYCJ9TyF6xnXFqjhdqmv5J900irN/g0P5jMvLT22krEXQ==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index c4f9a7fbe6..d9748d7478 100644 --- a/package.json +++ b/package.json @@ -50,10 +50,10 @@ "@codemirror/state": "^6.7.1", "@codemirror/view": "^6.43.6", "@puppeteer/browsers": "3.0.6", - "autoprefixer": "^10.5.2", + "autoprefixer": "^10.5.4", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", - "chromedriver": "^150.0.3", + "chromedriver": "^150.0.4", "cli-progress": "^3.12.0", "colors": "^1.4.0", "compression-webpack-plugin": "^12.0.0", @@ -61,7 +61,7 @@ "core-js": "^3.49.0", "cspell": "^10.0.1", "css-loader": "^7.1.4", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-plugin-jsdoc": "^50.8.0", "globals": "^17.7.0", "grunt": "^1.6.2", @@ -80,7 +80,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.16", + "postcss": "^8.5.21", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.1.1", "postcss-loader": "^8.2.1", @@ -88,7 +88,7 @@ "sitemap": "^9.0.1", "terser": "^5.49.0", "webpack": "^5.108.4", - "webpack-bundle-analyzer": "^5.3.0", + "webpack-bundle-analyzer": "^5.3.1", "webpack-dev-server": "^5.2.6", "webpack-node-externals": "^3.0.0", "worker-loader": "^3.0.8" @@ -123,7 +123,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.11", + "dompurify": "^3.4.12", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -143,7 +143,7 @@ "js-sha3": "^0.9.3", "jsesc": "^3.1.0", "json5": "^2.2.3", - "jsonata": "^2.2.1", + "jsonata": "^2.2.2", "jsonpath-plus": "^10.4.0", "jsonwebtoken": "9.0.3", "jsqr": "^1.4.0", @@ -158,7 +158,7 @@ "lz4js": "^0.2.0", "markdown-it": "^14.3.0", "moment": "^2.30.1", - "moment-timezone": "^0.6.2", + "moment-timezone": "^0.6.3", "ngeohash": "^0.6.3", "node-forge": "^1.4.0", "node-md6": "^0.1.0", @@ -170,7 +170,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.7.0", + "protobufjs": "^8.7.1", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", From 08b2b7b3dd6032989259388118bff8ad4c40ebff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:05:16 +0100 Subject: [PATCH 6/6] chore (deps): bump shell-quote from 1.8.4 to 1.10.0 (#2690) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 19b8d15b86..ba9655398c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16616,9 +16616,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "dev": true, "license": "MIT", "engines": {