From a7b5d4a24d36b11028c628dc3aaf98c0ab9abcd8 Mon Sep 17 00:00:00 2001 From: aeonframework Date: Thu, 30 Jul 2026 13:52:56 +0000 Subject: [PATCH] fix(deps): bump simple-git, tar, minimatch to patch critical CVEs simple-git 3.30.0 to 3.36.0 (packages/git): GHSA-hffm-xvc3-vprc (CVE-2026-6951, CVSS 9.8): RCE via --config bypass GHSA-r275-fr43-pm7q (CVE-2026-28292, CVSS 9.8): protocol.allow case bypass GHSA-jcxm-m3jx-f287 (CVE-2026-28291, CVSS 8.1): upload-pack option bypass tar 7.5.7 to 7.5.22 (packages/agent): GHSA-23hp-3jrh-7fpw (CVE-2026-59873, CVSS 9.2): Gzip bomb DoS GHSA-8x88-c5mf-7j5w (CVE-2026-59874, CVSS 8.7): negative-size infinite loop GHSA-r292-9mhp-454m (MODERATE): stack-overflow DoS via long paths minimatch 10.1.2 to 10.2.5 (packages/agent): GHSA-3ppc-4f35-3m26 (CVE-2026-26996, CVSS 8.7): ReDoS via repeated wildcards GHSA-23c5-xmqv-rm74 (HIGH): ReDoS via nested extglobs GHSA-7r86-cg39-jmmj (HIGH): ReDoS via multiple GLOBSTAR segments Run pnpm install at the repo root to update the lockfile. Detected by osv-scanner via https://github.com/aeonframework/aeon. --- packages/agent/package.json | 4 ++-- packages/git/package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/agent/package.json b/packages/agent/package.json index c4e12b6365..69c31d1d66 100644 --- a/packages/agent/package.json +++ b/packages/agent/package.json @@ -188,9 +188,9 @@ "fflate": "^0.8.2", "hono": "^4.11.7", "jsonwebtoken": "^9.0.2", - "minimatch": "^10.0.3", + "minimatch": "^10.2.5", "@modelcontextprotocol/sdk": "1.29.0", - "tar": "^7.5.0", + "tar": "^7.5.22", "uuid": "13.0.0", "yoga-wasm-web": "^0.3.3", "zod": "^4.2.0" diff --git a/packages/git/package.json b/packages/git/package.json index 5eca3f1928..cb9c84e7a9 100644 --- a/packages/git/package.json +++ b/packages/git/package.json @@ -28,6 +28,6 @@ "dependencies": { "@posthog/shared": "workspace:*", "git-url-parse": "^16.1.0", - "simple-git": "^3.30.0" + "simple-git": "^3.36.0" } }