chore(deps): Remove resolutions that no longer prevent downgrades (#12304)

* chore(deps): Remove resolutions that no longer prevent downgrades

Audited each resolution by removing it and running yarn install to check
whether any package would resolve to a lower version. Removed 31 entries
that were no-ops because the natural resolution already satisfies (or
exceeds) the resolution target — caret ranges that npm now publishes a
matching or higher version for, and one fast-xml-parser pin where the
underlying dependency moved.

Kept 13 entries: those that still prevent a regression, plus the @types/*
and prosemirror-transform pins that exist to dedupe transitive copies
against the project's own pinned versions.

* chore(deps): Bump @babel/preset-env to 7.29.5 to address GHSA-fv7c-fp4j-7gwp

@babel/plugin-transform-modules-systemjs <=7.29.3 generates arbitrary
code when compiling malicious input. Upgrading @babel/preset-env to
^7.29.5 brings in the patched ^7.29.4 transitively.

---------

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Tom Moor
2026-05-09 09:02:50 -04:00
committed by GitHub
parent 7a75433bdc
commit 4548fc00bf
2 changed files with 113 additions and 67 deletions
+111 -34
View File
@@ -742,7 +742,7 @@ __metadata:
languageName: node
linkType: hard
"@aws-sdk/xml-builder@npm:3.972.22":
"@aws-sdk/xml-builder@npm:^3.972.18":
version: 3.972.22
resolution: "@aws-sdk/xml-builder@npm:3.972.22"
dependencies:
@@ -1510,9 +1510,9 @@ __metadata:
languageName: node
linkType: hard
"@babel/plugin-transform-modules-systemjs@npm:^7.29.0":
version: 7.29.0
resolution: "@babel/plugin-transform-modules-systemjs@npm:7.29.0"
"@babel/plugin-transform-modules-systemjs@npm:^7.29.4":
version: 7.29.4
resolution: "@babel/plugin-transform-modules-systemjs@npm:7.29.4"
dependencies:
"@babel/helper-module-transforms": "npm:^7.28.6"
"@babel/helper-plugin-utils": "npm:^7.28.6"
@@ -1520,7 +1520,7 @@ __metadata:
"@babel/traverse": "npm:^7.29.0"
peerDependencies:
"@babel/core": ^7.0.0-0
checksum: 10c0/44ea502f2c990398b7d9adc5b44d9e1810a0a5e86eebc05c92d039458f0b3994fe243efa9353b90f8a648d8a91b79845fb353d8679d7324cc9de0162d732771d
checksum: 10c0/1da94f89ef8ba1aa1501136a80eb4c010c6a19f5550e10db84677b3ccb7a4934c8098f2b5134def87cf513bf05747ffa523d33722a1ea5a5c8ef956e9136c4c2
languageName: node
linkType: hard
@@ -1895,9 +1895,9 @@ __metadata:
languageName: node
linkType: hard
"@babel/preset-env@npm:^7.11.0, @babel/preset-env@npm:^7.29.3":
version: 7.29.3
resolution: "@babel/preset-env@npm:7.29.3"
"@babel/preset-env@npm:^7.11.0, @babel/preset-env@npm:^7.29.5":
version: 7.29.5
resolution: "@babel/preset-env@npm:7.29.5"
dependencies:
"@babel/compat-data": "npm:^7.29.3"
"@babel/helper-compilation-targets": "npm:^7.28.6"
@@ -1938,7 +1938,7 @@ __metadata:
"@babel/plugin-transform-member-expression-literals": "npm:^7.27.1"
"@babel/plugin-transform-modules-amd": "npm:^7.27.1"
"@babel/plugin-transform-modules-commonjs": "npm:^7.28.6"
"@babel/plugin-transform-modules-systemjs": "npm:^7.29.0"
"@babel/plugin-transform-modules-systemjs": "npm:^7.29.4"
"@babel/plugin-transform-modules-umd": "npm:^7.27.1"
"@babel/plugin-transform-named-capturing-groups-regex": "npm:^7.29.0"
"@babel/plugin-transform-new-target": "npm:^7.27.1"
@@ -1972,7 +1972,7 @@ __metadata:
semver: "npm:^6.3.1"
peerDependencies:
"@babel/core": ^7.0.0-0
checksum: 10c0/40591ca097502b547eaf844fceaafbc71aa726a86bec95b66ca4e762b2642a8dfc224eb9204a9d0d952ad62b6b326008f6be4dfc9e274e4438503e4975848372
checksum: 10c0/9d70ed5235f5f210bc793cd3e47ae7b108356c6d86b4ef3b4f9718e6ed5ec011dcd3d994e3d211e05e755e9442558eeb4723570bd2df3db7ba5863eaa98303e3
languageName: node
linkType: hard
@@ -8469,6 +8469,18 @@ __metadata:
languageName: node
linkType: hard
"ajv@npm:^8.0.0, ajv@npm:^8.17.1, ajv@npm:^8.6.0":
version: 8.20.0
resolution: "ajv@npm:8.20.0"
dependencies:
fast-deep-equal: "npm:^3.1.3"
fast-uri: "npm:^3.0.1"
json-schema-traverse: "npm:^1.0.0"
require-from-string: "npm:^2.0.2"
checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
languageName: node
linkType: hard
"ajv@npm:^8.18.0":
version: 8.18.0
resolution: "ajv@npm:8.18.0"
@@ -8990,7 +9002,7 @@ __metadata:
languageName: node
linkType: hard
"brace-expansion@npm:^1.1.13":
"brace-expansion@npm:^1.1.7":
version: 1.1.14
resolution: "brace-expansion@npm:1.1.14"
dependencies:
@@ -9000,7 +9012,7 @@ __metadata:
languageName: node
linkType: hard
"brace-expansion@npm:^2.0.2, brace-expansion@npm:^2.0.3":
"brace-expansion@npm:^2.0.1, brace-expansion@npm:^2.0.2":
version: 2.1.0
resolution: "brace-expansion@npm:2.1.0"
dependencies:
@@ -9306,18 +9318,22 @@ __metadata:
languageName: node
linkType: hard
"cheerio@npm:1.0.0-rc.12":
version: 1.0.0-rc.12
resolution: "cheerio@npm:1.0.0-rc.12"
"cheerio@npm:^1.0.0-rc.2":
version: 1.2.0
resolution: "cheerio@npm:1.2.0"
dependencies:
cheerio-select: "npm:^2.1.0"
dom-serializer: "npm:^2.0.0"
domhandler: "npm:^5.0.3"
domutils: "npm:^3.0.1"
htmlparser2: "npm:^8.0.1"
parse5: "npm:^7.0.0"
parse5-htmlparser2-tree-adapter: "npm:^7.0.0"
checksum: 10c0/c85d2f2461e3f024345b78e0bb16ad8e41492356210470dd1e7d5a91391da9fcf6c0a7cb48a9ba8820330153f0cedb4d0a60c7af15d96ecdb3092299b9d9c0cc
domutils: "npm:^3.2.2"
encoding-sniffer: "npm:^0.2.1"
htmlparser2: "npm:^10.1.0"
parse5: "npm:^7.3.0"
parse5-htmlparser2-tree-adapter: "npm:^7.1.0"
parse5-parser-stream: "npm:^7.1.2"
undici: "npm:^7.19.0"
whatwg-mimetype: "npm:^4.0.0"
checksum: 10c0/91a566aabfa9962f28056045bb7d92d79c0f8f3abb1fb86a852a9d1760556adddeb01a36b6f08fa7c133282375d387ae450a181a659e76c6a64016c30cc3f611
languageName: node
linkType: hard
@@ -10759,7 +10775,7 @@ __metadata:
languageName: node
linkType: hard
"domutils@npm:^3.0.1":
"domutils@npm:^3.0.1, domutils@npm:^3.2.2":
version: 3.2.2
resolution: "domutils@npm:3.2.2"
dependencies:
@@ -10981,6 +10997,16 @@ __metadata:
languageName: node
linkType: hard
"encoding-sniffer@npm:^0.2.1":
version: 0.2.1
resolution: "encoding-sniffer@npm:0.2.1"
dependencies:
iconv-lite: "npm:^0.6.3"
whatwg-encoding: "npm:^3.1.1"
checksum: 10c0/d6b591880788f3baf8dd1744636dd189d24a1ec93e6f9817267c60ac3458a5191ca70ab1a186fb67731beff1c3489c6527dfdc4718158ed8460ab2f400dd5e7d
languageName: node
linkType: hard
"encoding@npm:^0.1.13":
version: 0.1.13
resolution: "encoding@npm:0.1.13"
@@ -11057,6 +11083,13 @@ __metadata:
languageName: node
linkType: hard
"entities@npm:^7.0.1":
version: 7.0.1
resolution: "entities@npm:7.0.1"
checksum: 10c0/b4fb9937bb47ecb00aaaceb9db9cdd1cc0b0fb649c0e843d05cf5dbbd2e9d2df8f98721d8b1b286445689c72af7b54a7242fc2d63ef7c9739037a8c73363e7ca
languageName: node
linkType: hard
"env-ci@npm:7.3.0":
version: 7.3.0
resolution: "env-ci@npm:7.3.0"
@@ -12572,7 +12605,19 @@ __metadata:
languageName: node
linkType: hard
"htmlparser2@npm:^8.0.1, htmlparser2@npm:^8.0.2":
"htmlparser2@npm:^10.1.0":
version: 10.1.0
resolution: "htmlparser2@npm:10.1.0"
dependencies:
domelementtype: "npm:^2.3.0"
domhandler: "npm:^5.0.3"
domutils: "npm:^3.2.2"
entities: "npm:^7.0.1"
checksum: 10c0/36394e29b80cfcc5e78e0fa4d3aa21fdaac3e6778d23e5c933e625c290987cd9a724a2eb0753ab60ed0c69dfaba0ab115f0ee50fb112fd8f0c4d522e7e0089a2
languageName: node
linkType: hard
"htmlparser2@npm:^8.0.2":
version: 8.0.2
resolution: "htmlparser2@npm:8.0.2"
dependencies:
@@ -13001,7 +13046,7 @@ __metadata:
languageName: node
linkType: hard
"ip-address@npm:^10.2.0":
"ip-address@npm:^10.0.1, ip-address@npm:^10.2.0":
version: 10.2.0
resolution: "ip-address@npm:10.2.0"
checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a
@@ -14361,7 +14406,7 @@ __metadata:
languageName: node
linkType: hard
"lodash-es@npm:^4.18.1":
"lodash-es@npm:^4.17.21, lodash-es@npm:^4.17.23, lodash-es@npm:^4.18.1":
version: 4.18.1
resolution: "lodash-es@npm:4.18.1"
checksum: 10c0/35d4dcf87ef07f8d090f409447575800108057e360b445f590d0d25d09e3d1e33a163d2fc100d4d072b0f901d5e2fc533cd7c4bfd8eeb38a06abec693823c8b8
@@ -14501,7 +14546,7 @@ __metadata:
languageName: node
linkType: hard
"lodash@npm:^4.18.1":
"lodash@npm:^4.17.11, lodash@npm:^4.17.20, lodash@npm:^4.17.21, lodash@npm:^4.18.1":
version: 4.18.1
resolution: "lodash@npm:4.18.1"
checksum: 10c0/757228fc68805c59789e82185135cf85f05d0b2d3d54631d680ca79ec21944ec8314d4533639a14b8bcfbd97a517e78960933041a5af17ecb693ec6eecb99a27
@@ -14892,7 +14937,7 @@ __metadata:
languageName: node
linkType: hard
"minimatch@npm:9.0.9, minimatch@npm:^9.0.9":
"minimatch@npm:9.0.9, minimatch@npm:^9.0.4":
version: 9.0.9
resolution: "minimatch@npm:9.0.9"
dependencies:
@@ -14910,7 +14955,7 @@ __metadata:
languageName: node
linkType: hard
"minimatch@npm:^3.1.5":
"minimatch@npm:^3.0.2, minimatch@npm:^3.0.4, minimatch@npm:^3.1.1":
version: 3.1.5
resolution: "minimatch@npm:3.1.5"
dependencies:
@@ -14919,7 +14964,7 @@ __metadata:
languageName: node
linkType: hard
"minimatch@npm:^5.1.9":
"minimatch@npm:^5.0.1":
version: 5.1.9
resolution: "minimatch@npm:5.1.9"
dependencies:
@@ -15692,7 +15737,7 @@ __metadata:
"@babel/core": "npm:^7.28.6"
"@babel/plugin-proposal-decorators": "npm:^7.28.6"
"@babel/plugin-transform-class-properties": "npm:^7.27.1"
"@babel/preset-env": "npm:^7.29.3"
"@babel/preset-env": "npm:^7.29.5"
"@babel/preset-react": "npm:^7.28.5"
"@babel/preset-typescript": "npm:^7.28.5"
"@benrbray/prosemirror-math": "npm:^0.2.2"
@@ -16313,7 +16358,7 @@ __metadata:
languageName: node
linkType: hard
"parse5-htmlparser2-tree-adapter@npm:^7.0.0":
"parse5-htmlparser2-tree-adapter@npm:^7.1.0":
version: 7.1.0
resolution: "parse5-htmlparser2-tree-adapter@npm:7.1.0"
dependencies:
@@ -16323,7 +16368,16 @@ __metadata:
languageName: node
linkType: hard
"parse5@npm:^7.0.0, parse5@npm:^7.1.2":
"parse5-parser-stream@npm:^7.1.2":
version: 7.1.2
resolution: "parse5-parser-stream@npm:7.1.2"
dependencies:
parse5: "npm:^7.0.0"
checksum: 10c0/e236c61000d38ecad369e725a48506b051cebad8abb00e6d4e8bff7aa85c183820fcb45db1559cc90955bdbbdbd665ea94c41259594e74566fff411478dc7fcb
languageName: node
linkType: hard
"parse5@npm:^7.0.0, parse5@npm:^7.1.2, parse5@npm:^7.3.0":
version: 7.3.0
resolution: "parse5@npm:7.3.0"
dependencies:
@@ -16683,14 +16737,14 @@ __metadata:
languageName: node
linkType: hard
"picomatch@npm:^2.3.2":
"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.2.2, picomatch@npm:^2.3.1":
version: 2.3.2
resolution: "picomatch@npm:2.3.2"
checksum: 10c0/a554d1709e59be97d1acb9eaedbbc700a5c03dbd4579807baed95100b00420bc729335440ef15004ae2378984e2487a7c1cebd743cfdb72b6fa9ab69223c0d61
languageName: node
linkType: hard
"picomatch@npm:^4.0.4":
"picomatch@npm:^4.0.2, picomatch@npm:^4.0.3, picomatch@npm:^4.0.4":
version: 4.0.4
resolution: "picomatch@npm:4.0.4"
checksum: 10c0/e2c6023372cc7b5764719a5ffb9da0f8e781212fa7ca4bd0562db929df8e117460f00dff3cb7509dacfc06b86de924b247f504d0ce1806a37fac4633081466b0
@@ -17209,7 +17263,7 @@ __metadata:
languageName: node
linkType: hard
"qs@npm:^6.14.2":
"qs@npm:^6.11.0, qs@npm:^6.14.0, qs@npm:^6.5.2":
version: 6.15.1
resolution: "qs@npm:6.15.1"
dependencies:
@@ -20095,6 +20149,13 @@ __metadata:
languageName: node
linkType: hard
"undici@npm:^7.19.0":
version: 7.25.0
resolution: "undici@npm:7.25.0"
checksum: 10c0/02a0b45dc14eb91bc488948750232450fe52f27a6b08086d6ac6736bb47908d600fe3a96d346f12eab24729c782e5c2f693bc8e8eca6696d4e4c09b1ed4cb4ec
languageName: node
linkType: hard
"unfetch@npm:^4.2.0":
version: 4.2.0
resolution: "unfetch@npm:4.2.0"
@@ -20865,6 +20926,15 @@ __metadata:
languageName: node
linkType: hard
"whatwg-encoding@npm:^3.1.1":
version: 3.1.1
resolution: "whatwg-encoding@npm:3.1.1"
dependencies:
iconv-lite: "npm:0.6.3"
checksum: 10c0/273b5f441c2f7fda3368a496c3009edbaa5e43b71b09728f90425e7f487e5cef9eb2b846a31bd760dd8077739c26faf6b5ca43a5f24033172b003b72cf61a93e
languageName: node
linkType: hard
"whatwg-mimetype@npm:^3.0.0":
version: 3.0.0
resolution: "whatwg-mimetype@npm:3.0.0"
@@ -20872,6 +20942,13 @@ __metadata:
languageName: node
linkType: hard
"whatwg-mimetype@npm:^4.0.0":
version: 4.0.0
resolution: "whatwg-mimetype@npm:4.0.0"
checksum: 10c0/a773cdc8126b514d790bdae7052e8bf242970cebd84af62fb2f35a33411e78e981f6c0ab9ed1fe6ec5071b09d5340ac9178e05b52d35a9c4bcf558ba1b1551df
languageName: node
linkType: hard
"whatwg-url@npm:^12.0.0, whatwg-url@npm:^12.0.1":
version: 12.0.1
resolution: "whatwg-url@npm:12.0.1"