mirror of
https://github.com/formbricks/formbricks.git
synced 2026-05-14 11:30:11 -05:00
80e1cc2411
Updates direct dependencies with known CVEs and adds/tightens pnpm overrides for transitive dependencies that cannot be updated directly. Direct updates: - next: 16.1.7 → 16.2.6 (middleware bypass, SSRF, DoS, XSS CVEs) - lodash: 4.17.23 → 4.18.1 (code injection via template CVE-2025-62616) - nodemailer: 8.0.2 → 8.0.7 (SMTP injection CVEs) - uuid: 13.0.0 → 13.0.2 (buffer bounds check CVE) - postcss: 8.5.8 → 8.5.14 (XSS via unescaped </style> CVE-2025-62695) - @opentelemetry suite: 0.213.0 → 0.217.0 / 2.6.0 → 2.7.1 Override additions/updates: - protobufjs@7: 7.5.8, protobufjs@8: 8.2.0 (GHSA-xq3m-2v4x-88gg arbitrary code execution) - @protobufjs/utf8: 1.1.1 (overlong UTF-8 CVE) - vite@7: 7.3.3, vite@8: 8.0.12 (GHSA-v2wj-q39q-566r fs.deny bypass, GHSA-p9ff-h696-f583 file read) - node-forge: 1.4.0 (multiple signature forgery / DoS CVEs) - defu: 6.1.7 (prototype pollution CVE-2025-62629) - brace-expansion@1/2/5: patched (ReDoS CVE-2025-67313) - picomatch@2/4: patched (ReDoS CVE-2025-60538/63394) - dompurify: 3.4.2 (XSS CVE-2025-26791) - ip-address: 10.1.1 (ReDoS CVE-2025-62629) - fast-uri: 3.1.2 (CVE-2025-48944/48945) - fast-xml-parser: 5.7.0 (multiple CVEs) - yaml: 2.8.3 (CVE-2025-63675) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
133 lines
6.2 KiB
JSON
133 lines
6.2 KiB
JSON
{
|
|
"name": "formbricks",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"workspaces": [
|
|
"apps/*",
|
|
"packages/*"
|
|
],
|
|
"prisma": {
|
|
"schema": "packages/database/schema.prisma"
|
|
},
|
|
"scripts": {
|
|
"agents:update": "npx @next/codemod@canary agents-md --output AGENTS.md",
|
|
"clean:all": "turbo run clean && rimraf node_modules pnpm-lock.yaml .turbo coverage out",
|
|
"clean": "turbo run clean && rimraf node_modules .turbo coverage out",
|
|
"build": "turbo run build",
|
|
"build:dev": "turbo run build:dev",
|
|
"db:migrate:dev": "turbo run db:migrate:dev",
|
|
"db:migrate:deploy": "turbo run db:migrate:deploy",
|
|
"db:start": "turbo run db:start",
|
|
"db:push": "turbo run db:push",
|
|
"db:seed": "turbo run db:seed",
|
|
"db:seed:clear": "turbo run db:seed -- -- --clear",
|
|
"db:up": "docker compose -f docker-compose.dev.yml up -d",
|
|
"db:down": "docker compose -f docker-compose.dev.yml down",
|
|
"go": "pnpm db:up && turbo run go --concurrency 20",
|
|
"dev": "turbo run dev --parallel",
|
|
"pre-commit": "lint-staged",
|
|
"start": "turbo run start --parallel",
|
|
"format": "prettier --write \"**/*.{ts,tsx,md}\"",
|
|
"generate": "turbo run generate",
|
|
"lint": "turbo run lint",
|
|
"test": "turbo run test --no-cache",
|
|
"test:coverage": "turbo run test:coverage --no-cache",
|
|
"test:e2e": "playwright test",
|
|
"test-e2e:azure": "pnpm test:e2e -c playwright.service.config.ts --workers=10",
|
|
"prepare": "husky install",
|
|
"storybook": "turbo run storybook",
|
|
"fb-migrate-dev": "pnpm --filter @formbricks/database create-migration && pnpm prisma generate",
|
|
"i18n:surveys:generate": "pnpm --filter @formbricks/surveys i18n:generate",
|
|
"i18n:web:generate": "pnpm --filter @formbricks/web i18n:generate",
|
|
"generate-translations": "pnpm i18n:web:generate && pnpm i18n:surveys:generate",
|
|
"scan-translations": "pnpm --filter @formbricks/i18n-utils scan-translations",
|
|
"i18n": "pnpm generate-translations && pnpm scan-translations",
|
|
"i18n:validate": "pnpm scan-translations",
|
|
"dev:setup": "bash scripts/setup-dev-env.sh"
|
|
},
|
|
"dependencies": {
|
|
"react": "19.2.4",
|
|
"react-dom": "19.2.4"
|
|
},
|
|
"devDependencies": {
|
|
"@azure/playwright": "1.1.2",
|
|
"@formbricks/eslint-config": "workspace:*",
|
|
"@playwright/test": "1.58.2",
|
|
"eslint": "8.57.1",
|
|
"husky": "9.1.7",
|
|
"lint-staged": "16.3.3",
|
|
"rimraf": "6.1.3",
|
|
"tsx": "4.21.0",
|
|
"turbo": "2.8.16"
|
|
},
|
|
"lint-staged": {
|
|
"(apps|packages)/**/*.{js,ts,jsx,tsx}": [
|
|
"prettier --write"
|
|
],
|
|
"*.json": [
|
|
"prettier --write"
|
|
],
|
|
"packages/database/schema.prisma": [
|
|
"prisma format"
|
|
]
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"packageManager": "pnpm@10.32.1",
|
|
"nextBundleAnalysis": {
|
|
"budget": 358400,
|
|
"budgetPercentIncreaseRed": 20,
|
|
"minimumChangeThreshold": 0,
|
|
"showDetails": true
|
|
},
|
|
"pnpm": {
|
|
"overrides": {
|
|
"@hono/node-server": "1.19.13",
|
|
"@microsoft/api-extractor>minimatch": "10.2.4",
|
|
"@protobufjs/utf8": "1.1.1",
|
|
"@react-email/preview-server>next": "16.2.6",
|
|
"@tootallnate/once": "3.0.1",
|
|
"@xmldom/xmldom": "0.9.10",
|
|
"ajv@6": "6.14.0",
|
|
"axios": "1.16.0",
|
|
"brace-expansion@1": "1.1.14",
|
|
"brace-expansion@2": "2.0.3",
|
|
"brace-expansion@5": "5.0.6",
|
|
"defu": "6.1.7",
|
|
"dompurify": "3.4.2",
|
|
"effect": "3.20.0",
|
|
"fast-uri": "3.1.2",
|
|
"fast-xml-parser": "5.7.0",
|
|
"flatted": "3.4.2",
|
|
"hono": "4.12.18",
|
|
"ip-address": "10.1.1",
|
|
"lodash": "4.18.1",
|
|
"lodash-es": "4.18.1",
|
|
"node-forge": "1.4.0",
|
|
"picomatch@2": "2.3.2",
|
|
"picomatch@4": "4.0.4",
|
|
"postcss": "8.5.14",
|
|
"protobufjs@7": "7.5.8",
|
|
"protobufjs@8": "8.2.0",
|
|
"qs": "6.14.2",
|
|
"rollup": "4.59.0",
|
|
"socket.io-parser": "4.2.6",
|
|
"tar": ">=7.5.11",
|
|
"typeorm": ">=0.3.26",
|
|
"undici": "7.24.0",
|
|
"uuid@11": "11.1.1",
|
|
"vite@7": "7.3.3",
|
|
"vite@8": "8.0.12",
|
|
"yaml": "2.8.3",
|
|
"diff": ">=8.0.3"
|
|
},
|
|
"comments": {
|
|
"overrides": "Security fixes for transitive dependencies. Remove when upstream packages update: @hono/node-server/hono - awaiting Prisma update | @microsoft/api-extractor>minimatch - awaiting api-extractor update | @protobufjs/utf8 (CVE overlong UTF-8) - awaiting @opentelemetry/otlp-transformer update | @react-email/preview-server>next - awaiting react-email update | @tootallnate/once - awaiting sqlite3/node-gyp chain update | @xmldom/xmldom (CVE-2025-63067/63068) - awaiting @boxyhq/saml20 update | ajv@6 - awaiting @microsoft/tsdoc-config/eslint update | axios (CVE-2025-58754 et al.) - awaiting @boxyhq/saml-jackson update | brace-expansion@1/2/5 (CVE-2025-67313) - awaiting eslint/typeorm/typescript-eslint update | defu (CVE-2025-62629) - awaiting @prisma/config update | dompurify (CVE-2025-26791 et al.) - awaiting posthog-js/isomorphic-dompurify update | effect - awaiting Prisma update | fast-uri (CVE-2025-48944/48945) - awaiting ajv/schema-utils update | fast-xml-parser (CVE-2026-25896 et al.) - awaiting azure/core-xml update | flatted - awaiting eslint/flat-cache update | ip-address (CVE-2025-62629) - awaiting mongodb/socks update | lodash/lodash-es (CVE-2025-62616) - awaiting @boxyhq/saml-jackson/@trivago/prettier-plugin update | node-forge - awaiting @boxyhq/saml-jackson update | picomatch@2/4 (CVE-2025-60538/63394) - awaiting lint-staged/storybook update | postcss (CVE-2025-62695) - awaiting next.js to unpin postcss | protobufjs@7/8 (GHSA-xq3m-2v4x-88gg et al.) - awaiting @grpc/proto-loader/otlp-transformer update | qs - awaiting googleapis/googleapis-common update | rollup - awaiting Vite patch adoption | socket.io-parser - awaiting react-email/socket.io update | tar - awaiting @boxyhq/saml-jackson/sqlite3 updates | typeorm - awaiting @boxyhq/saml-jackson update | undici - awaiting jsdom/vitest/isomorphic-dompurify updates | uuid@11 (CVE-2025-61475) - awaiting typeorm update | vite@7/8 (GHSA-v2wj-q39q-566r/p9ff-h696-f583) - awaiting workspace packages to update vite dependency | yaml (CVE-2025-63675) - awaiting lint-staged update | diff - awaiting upstream patch range adoption"
|
|
},
|
|
"patchedDependencies": {
|
|
"next-auth@4.24.13": "patches/next-auth@4.24.13.patch"
|
|
}
|
|
}
|
|
}
|