From 74ddc7ad253043d0f5ccb3efc2b55e5c2b076ef6 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 16 Aug 2026 11:06:45 -0700 Subject: [PATCH] fix(deps): force adm-zip past CVE-2026-39244 via an override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-derived from PR #2485 as a resolution override rather than its direct-dep bump: adm-zip reaches the tree only transitively (onnxruntime-node pins ^0.5.16), so a top-level copy at 0.6.0 would leave onnxruntime-node loading the vulnerable 0.5.17 — which is exactly what the scanner PR's own lockfile showed. The override forces every resolution to ^0.6.0. Co-authored-by: anupamme Co-Authored-By: Claude Fable 5 --- bun.lock | 3 ++- package.json | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/bun.lock b/bun.lock index e12f18e33..0aa5b829d 100644 --- a/bun.lock +++ b/bun.lock @@ -27,6 +27,7 @@ "playwright-core@1.62.1": "patches/playwright-core@1.62.1.patch", }, "overrides": { + "adm-zip": "^0.6.0", "basic-ftp": "5.3.1", }, "packages": { @@ -180,7 +181,7 @@ "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="], - "adm-zip": ["adm-zip@0.5.17", "", {}, "sha512-+Ut8d9LLqwEvHHJl1+PIHqoyDxFgVN847JTVM3Izi3xHDWPE4UtzzXysMZQs64DMcrJfBeS/uoEP4AD3HQHnQQ=="], + "adm-zip": ["adm-zip@0.6.0", "", {}, "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg=="], "agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="], diff --git a/package.json b/package.json index 55a97927b..e60f18ebd 100644 --- a/package.json +++ b/package.json @@ -81,6 +81,7 @@ "xterm-addon-fit": "^0.8.0" }, "overrides": { + "adm-zip": "^0.6.0", "basic-ftp": "5.3.1" }, "patchedDependencies": {