mirror of
https://github.com/Kong/insomnia.git
synced 2026-10-12 02:06:34 +00:00
kwburns-kong
c4b7b0bf56
* fix: bump @xmldom/xmldom to ^0.9.12 (CVE-2026-41675) 0.9.10 has a known parser vulnerability; 0.9.12 is the latest patched release. * fix: bump dompurify to ^3.4.14 3.4.13 has a known sanitizer bypass; 3.4.14 is the patched release. * fix: bump ajv to ^8.20.0 8.18.0 has a known prototype-pollution issue in schema compilation; 8.20.0 is the patched release. * fix: bump es-toolkit to ^1.51.0 1.45.1 has a known ReDoS in one of its string utilities; 1.51.0 is the patched release. * fix: bump @apidevtools/swagger-parser to 12.1.0 Pulls in json-schema-ref-parser 14.0.1, resolving a known vulnerability in the $ref-resolution path used when validating imported OpenAPI/Swagger documents. Only SwaggerParser.validate() is used at the two call sites and its signature is unchanged across this range. * fix: bump @sentry/electron to ^7.17.0 Pulls in @sentry/node 10.70.0, resolving vulnerabilities in its bundled @opentelemetry/core and cjs-module-lexer instrumentation dependencies. Sentry.init options, captureException, browserTracingIntegration, and getCurrentScope().setUser() are all used unchanged across this range. * fix: bump zod to ^4.4.0 3.25.76 has a known validation-bypass fixed only in the v4 line. The app's own schema code already imports from the zod/v4 subpath, so no source changes are needed for the bump itself. * fix: bump @rjsf/core, @rjsf/utils, @rjsf/validator-ajv8 to 6.8.0 Moves off the 6.0.0 beta onto the stable release line, which pulls in markdown-to-jsx 9.x and resolves a known vulnerability in the pinned 7.x line. The withTheme/FormProps/RJSFSchema/UiSchema/validateForm API surface used by this app's JSON-schema forms is unchanged across this range. * fix: refresh jose lockfile entry to 6.2.10 6.2.2 has a known vulnerability; 6.2.10 is already within the existing allowed range (^6.1.3) declared by @modelcontextprotocol/sdk, so no manifest change is needed, just an up-to-date resolution. * fix: adapt rjsf theme templates to @rjsf/utils 6.8.0 prop changes WrapIfAdditionalTemplate's onKeyChange/onDropPropertyClick became onKeyRenameBlur/onRemoveProperty, ObjectFieldTemplate's idSchema/onAddClick became fieldPathId/onAddProperty, and ArrayFieldTemplate no longer receives raw item pieces - items are now pre-rendered elements, so the per-item border/delete-button layout moved into a new ArrayFieldItemTemplate. * Revert "fix: bump zod to ^4.4.0" This reverts commit 54f1d5aa4c81ff64bf4cb9f9d478440b7311e2cd. The v3 to v4 bump breaks real-world collection validation: import-v5-parser's discriminated/recursive union schemas reject valid v5 collection files under the released [email protected] (unlike the bundled zod/v4 preview subpath used during development), failing import, export, and CLI collection-run end-to-end tests. Deferring this upgrade separately rather than shipping a functional regression. * chore: regenerate lockfile after rebase onto develop * fix: bump undici to ^7.29.1 * fix: bump @xmldom/xmldom 0.8.x to 0.8.15 * fix: bump proxy-addr to 2.0.8 * fix: bump compression to 1.8.2 * fix: bump source-map-js to 1.2.2 * fix: bump http-cache-semantics to 4.3.0 * fix: bump fast-uri to 3.1.8 * fix: bump proxy-addr, compression, source-map-js, http-cache-semantics, fast-uri in component-docs lockfile