Files
formbricks/package.json
T
Matti Nannt 80e1cc2411 fix: patch transitive and direct dependency security vulnerabilities for 4.9
Updates direct dependencies with known CVEs and adds/tightens pnpm overrides
for transitive dependencies that cannot be updated directly.

Direct updates:
- next: 16.1.7 → 16.2.6 (middleware bypass, SSRF, DoS, XSS CVEs)
- lodash: 4.17.23 → 4.18.1 (code injection via template CVE-2025-62616)
- nodemailer: 8.0.2 → 8.0.7 (SMTP injection CVEs)
- uuid: 13.0.0 → 13.0.2 (buffer bounds check CVE)
- postcss: 8.5.8 → 8.5.14 (XSS via unescaped </style> CVE-2025-62695)
- @opentelemetry suite: 0.213.0 → 0.217.0 / 2.6.0 → 2.7.1

Override additions/updates:
- protobufjs@7: 7.5.8, protobufjs@8: 8.2.0 (GHSA-xq3m-2v4x-88gg arbitrary code execution)
- @protobufjs/utf8: 1.1.1 (overlong UTF-8 CVE)
- vite@7: 7.3.3, vite@8: 8.0.12 (GHSA-v2wj-q39q-566r fs.deny bypass, GHSA-p9ff-h696-f583 file read)
- node-forge: 1.4.0 (multiple signature forgery / DoS CVEs)
- defu: 6.1.7 (prototype pollution CVE-2025-62629)
- brace-expansion@1/2/5: patched (ReDoS CVE-2025-67313)
- picomatch@2/4: patched (ReDoS CVE-2025-60538/63394)
- dompurify: 3.4.2 (XSS CVE-2025-26791)
- ip-address: 10.1.1 (ReDoS CVE-2025-62629)
- fast-uri: 3.1.2 (CVE-2025-48944/48945)
- fast-xml-parser: 5.7.0 (multiple CVEs)
- yaml: 2.8.3 (CVE-2025-63675)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-12 21:33:15 +02:00

133 lines
6.2 KiB
JSON

{
"name": "formbricks",
"version": "0.0.0",
"private": true,
"workspaces": [
"apps/*",
"packages/*"
],
"prisma": {
"schema": "packages/database/schema.prisma"
},
"scripts": {
"agents:update": "npx @next/codemod@canary agents-md --output AGENTS.md",
"clean:all": "turbo run clean && rimraf node_modules pnpm-lock.yaml .turbo coverage out",
"clean": "turbo run clean && rimraf node_modules .turbo coverage out",
"build": "turbo run build",
"build:dev": "turbo run build:dev",
"db:migrate:dev": "turbo run db:migrate:dev",
"db:migrate:deploy": "turbo run db:migrate:deploy",
"db:start": "turbo run db:start",
"db:push": "turbo run db:push",
"db:seed": "turbo run db:seed",
"db:seed:clear": "turbo run db:seed -- -- --clear",
"db:up": "docker compose -f docker-compose.dev.yml up -d",
"db:down": "docker compose -f docker-compose.dev.yml down",
"go": "pnpm db:up && turbo run go --concurrency 20",
"dev": "turbo run dev --parallel",
"pre-commit": "lint-staged",
"start": "turbo run start --parallel",
"format": "prettier --write \"**/*.{ts,tsx,md}\"",
"generate": "turbo run generate",
"lint": "turbo run lint",
"test": "turbo run test --no-cache",
"test:coverage": "turbo run test:coverage --no-cache",
"test:e2e": "playwright test",
"test-e2e:azure": "pnpm test:e2e -c playwright.service.config.ts --workers=10",
"prepare": "husky install",
"storybook": "turbo run storybook",
"fb-migrate-dev": "pnpm --filter @formbricks/database create-migration && pnpm prisma generate",
"i18n:surveys:generate": "pnpm --filter @formbricks/surveys i18n:generate",
"i18n:web:generate": "pnpm --filter @formbricks/web i18n:generate",
"generate-translations": "pnpm i18n:web:generate && pnpm i18n:surveys:generate",
"scan-translations": "pnpm --filter @formbricks/i18n-utils scan-translations",
"i18n": "pnpm generate-translations && pnpm scan-translations",
"i18n:validate": "pnpm scan-translations",
"dev:setup": "bash scripts/setup-dev-env.sh"
},
"dependencies": {
"react": "19.2.4",
"react-dom": "19.2.4"
},
"devDependencies": {
"@azure/playwright": "1.1.2",
"@formbricks/eslint-config": "workspace:*",
"@playwright/test": "1.58.2",
"eslint": "8.57.1",
"husky": "9.1.7",
"lint-staged": "16.3.3",
"rimraf": "6.1.3",
"tsx": "4.21.0",
"turbo": "2.8.16"
},
"lint-staged": {
"(apps|packages)/**/*.{js,ts,jsx,tsx}": [
"prettier --write"
],
"*.json": [
"prettier --write"
],
"packages/database/schema.prisma": [
"prisma format"
]
},
"engines": {
"node": ">=20.0.0"
},
"packageManager": "pnpm@10.32.1",
"nextBundleAnalysis": {
"budget": 358400,
"budgetPercentIncreaseRed": 20,
"minimumChangeThreshold": 0,
"showDetails": true
},
"pnpm": {
"overrides": {
"@hono/node-server": "1.19.13",
"@microsoft/api-extractor>minimatch": "10.2.4",
"@protobufjs/utf8": "1.1.1",
"@react-email/preview-server>next": "16.2.6",
"@tootallnate/once": "3.0.1",
"@xmldom/xmldom": "0.9.10",
"ajv@6": "6.14.0",
"axios": "1.16.0",
"brace-expansion@1": "1.1.14",
"brace-expansion@2": "2.0.3",
"brace-expansion@5": "5.0.6",
"defu": "6.1.7",
"dompurify": "3.4.2",
"effect": "3.20.0",
"fast-uri": "3.1.2",
"fast-xml-parser": "5.7.0",
"flatted": "3.4.2",
"hono": "4.12.18",
"ip-address": "10.1.1",
"lodash": "4.18.1",
"lodash-es": "4.18.1",
"node-forge": "1.4.0",
"picomatch@2": "2.3.2",
"picomatch@4": "4.0.4",
"postcss": "8.5.14",
"protobufjs@7": "7.5.8",
"protobufjs@8": "8.2.0",
"qs": "6.14.2",
"rollup": "4.59.0",
"socket.io-parser": "4.2.6",
"tar": ">=7.5.11",
"typeorm": ">=0.3.26",
"undici": "7.24.0",
"uuid@11": "11.1.1",
"vite@7": "7.3.3",
"vite@8": "8.0.12",
"yaml": "2.8.3",
"diff": ">=8.0.3"
},
"comments": {
"overrides": "Security fixes for transitive dependencies. Remove when upstream packages update: @hono/node-server/hono - awaiting Prisma update | @microsoft/api-extractor>minimatch - awaiting api-extractor update | @protobufjs/utf8 (CVE overlong UTF-8) - awaiting @opentelemetry/otlp-transformer update | @react-email/preview-server>next - awaiting react-email update | @tootallnate/once - awaiting sqlite3/node-gyp chain update | @xmldom/xmldom (CVE-2025-63067/63068) - awaiting @boxyhq/saml20 update | ajv@6 - awaiting @microsoft/tsdoc-config/eslint update | axios (CVE-2025-58754 et al.) - awaiting @boxyhq/saml-jackson update | brace-expansion@1/2/5 (CVE-2025-67313) - awaiting eslint/typeorm/typescript-eslint update | defu (CVE-2025-62629) - awaiting @prisma/config update | dompurify (CVE-2025-26791 et al.) - awaiting posthog-js/isomorphic-dompurify update | effect - awaiting Prisma update | fast-uri (CVE-2025-48944/48945) - awaiting ajv/schema-utils update | fast-xml-parser (CVE-2026-25896 et al.) - awaiting azure/core-xml update | flatted - awaiting eslint/flat-cache update | ip-address (CVE-2025-62629) - awaiting mongodb/socks update | lodash/lodash-es (CVE-2025-62616) - awaiting @boxyhq/saml-jackson/@trivago/prettier-plugin update | node-forge - awaiting @boxyhq/saml-jackson update | picomatch@2/4 (CVE-2025-60538/63394) - awaiting lint-staged/storybook update | postcss (CVE-2025-62695) - awaiting next.js to unpin postcss | protobufjs@7/8 (GHSA-xq3m-2v4x-88gg et al.) - awaiting @grpc/proto-loader/otlp-transformer update | qs - awaiting googleapis/googleapis-common update | rollup - awaiting Vite patch adoption | socket.io-parser - awaiting react-email/socket.io update | tar - awaiting @boxyhq/saml-jackson/sqlite3 updates | typeorm - awaiting @boxyhq/saml-jackson update | undici - awaiting jsdom/vitest/isomorphic-dompurify updates | uuid@11 (CVE-2025-61475) - awaiting typeorm update | vite@7/8 (GHSA-v2wj-q39q-566r/p9ff-h696-f583) - awaiting workspace packages to update vite dependency | yaml (CVE-2025-63675) - awaiting lint-staged update | diff - awaiting upstream patch range adoption"
},
"patchedDependencies": {
"next-auth@4.24.13": "patches/next-auth@4.24.13.patch"
}
}
}