From 0a66f17ddad340ba41ec523db188a1d0afd82dbd Mon Sep 17 00:00:00 2001 From: Matthew Murray Date: Mon, 17 Aug 2026 13:13:25 +0100 Subject: [PATCH] Pin e2e form-data and shell-quote to patched versions The example app's e2e harness resolved form-data 4.0.2 (GHSA-fjxv-7rqg-78g4, CVSS 9.4) and shell-quote 1.8.2 (GHSA-w7jw-789q-3m8p, CVSS 9.2). Adds yarn resolutions pinning both to patched releases. Co-Authored-By: Claude Opus 5 (1M context) --- examples/example/e2e/package.json | 4 ++++ examples/example/e2e/yarn.lock | 24 ++++++++---------------- 2 files changed, 12 insertions(+), 16 deletions(-) diff --git a/examples/example/e2e/package.json b/examples/example/e2e/package.json index afeac650..e8f375cc 100644 --- a/examples/example/e2e/package.json +++ b/examples/example/e2e/package.json @@ -28,5 +28,9 @@ "ts-node": "^10.0.0", "typescript": "^4.3.2", "wdio-chromedriver-service": "^8.1.1" + }, + "resolutions": { + "form-data": "4.0.5", + "shell-quote": "1.10.0" } } diff --git a/examples/example/e2e/yarn.lock b/examples/example/e2e/yarn.lock index 9b3b3af0..87635652 100644 --- a/examples/example/e2e/yarn.lock +++ b/examples/example/e2e/yarn.lock @@ -2814,23 +2814,15 @@ foreground-child@^3.1.0: cross-spawn "^7.0.0" signal-exit "^4.0.1" -form-data@4.0.2: - version "4.0.2" - resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.2.tgz#35cabbdd30c3ce73deb2c42d3c8d3ed9ca51794c" - integrity sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w== +form-data@4.0.2, form-data@^4.0.0: + version "4.0.5" + resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz" + integrity sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" es-set-tostringtag "^2.1.0" - mime-types "^2.1.12" - -form-data@^4.0.0: - version "4.0.1" - resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.1.tgz" - integrity sha512-tzN8e4TX8+kkxGPK8D5u0FNmjPUjw3lwC9lSLxxoB/+GtsJG91CO8bSWy73APlgAZzZbXEYZJuxjkHH2w+Ezhw== - dependencies: - asynckit "^0.4.0" - combined-stream "^1.0.8" + hasown "^2.0.2" mime-types "^2.1.12" formdata-polyfill@^4.0.10: @@ -4970,9 +4962,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@1.8.2, shell-quote@^1.8.1: - version "1.8.2" - resolved "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.2.tgz" - integrity sha512-AzqKpGKjrj7EM6rKVQEPpB288oCfnrEIuyoT9cyF4nmGa7V8Zk6f7RRqYisX8X9m+Q7bd632aZW4ky7EhbQztA== + version "1.10.0" + resolved "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz" + integrity sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA== side-channel-list@^1.0.0: version "1.0.0"