🔒 修复 pnpm audit 全部安全警告 (20260921)

[cyfung1031]

Summary

pnpm audit reported 1 critical, 26 high, 20 moderate, 3 low vulnerabilities (websocket-driver, brace-expansion, js-yaml, shell-quote, body-parser, dompurify, fast-uri, react-router, postcss, hono, nanoid, fast-xml-parser, browserslist, @humanfs/node, qs, vitest, webpack-dev-server, and more). This PR resolves all of them — pnpm audit now reports 0 critical / 0 high / 0 moderate / 0 low.

• Refreshed the locked resolution for direct dependencies already permitted by their existing package.json ranges: dompurify, fast-xml-parser, react-router-dom, webdav, postcss, vitest/@vitest/coverage-v8, eslint, postcss-loader, concurrently.
• Bumped the exactly-pinned @modelcontextprotocol/sdk from 1.29.0 to 1.30.0.
• Extended this repo's existing pnpm-workspace.yaml overrides table (the precise "parent@version>package": "exact-version" convention from 修复所有 npm vulnerability #1350) to refresh stale entries and add new ones for transitive vulnerabilities whose immediate parent's own semver range already permits the patched version but pnpm won't reach for it without an explicit override: brace-expansion (both the webdav>minimatch and crx>archiver>glob>minimatch chains, covered separately since they resolve to different minimatch majors), js-yaml, hono, browserslist/baseline-browser-mapping, @humanfs/node.
• The @rspack/cli → @rspack/dev-server → webpack-dev-server chain (websocket-driver, shell-quote, webpack-dev-server itself, body-parser, qs, fast-uri) turned out to be fixable the same way, in-place on the existing @rspack/dev-server@1.1.5 release, by bumping the override targets (webpack-dev-server 5.2.5→5.2.6, shell-quote→1.10.0, fast-uri→3.1.7, qs/body-parser→6.16.0/1.20.8) — all within their respective parents' (webpack-dev-server, launch-editor, ajv, express) own declared compatible ranges. No major-version bump of @rspack/cli/@rspack/core was needed, so there's no separate rspack-migration PR.
• Every override target was checked against this repo's minimumReleaseAge: 10080 (7-day) cooldown gate; where the newest patched release was too fresh (e.g. brace-expansion 1.1.21/2.1.7, fast-uri 3.1.8, published within the last week), used the next-older release that still clears the vulnerable-version threshold (brace-expansion 1.1.18/2.1.4, fast-uri 3.1.7).

An earlier revision of this PR added a parallel pnpm.overrides block directly in package.json and, based on a stale read of the situation, proposed a separate follow-up PR to bump @rspack/cli/@rspack/core to 2.x as the only way to close the remaining dev-server-chain findings. Neither was correct: the package.json block duplicated (and could drift from) the existing pnpm-workspace.yaml overrides mechanism, and the rspack major bump turned out to be unnecessary once the override targets were refreshed. Both have been corrected in the current revision.

Test plan

• pnpm audit — 1 critical / 26 high / 20 moderate / 3 low → 0 / 0 / 0 / 0
• pnpm run typecheck — passes
• pnpm run build — passes (only pre-existing bundle-size/critical-dependency warnings)
• pnpm run test:ci — 373 test files / 4837 tests pass
• pnpm run lint:ci — passes
• Note: this project's dev/build scripts invoke plain rspack (watch mode), never rspack serve, so the @rspack/dev-server/webpack-dev-server code path isn't exercised by this project's own workflow either way — the fix was still applied for defense in depth and to clear the audit.

🤖 Generated with Claude Code

Follow-up (2026-10-08)

2f3589f — new advisories. Advisories published after the first revision brought pnpm audit back to 3 critical / 10 high / 8 moderate / 2 low. Direct dependencies: @modelcontextprotocol/sdk 1.30.0→1.31.0 (OAuth credential leak; we don't pass an authProvider) and dompurify ^3.4.16 (IN_PLACE XSS; sanitize.ts doesn't use IN_PLACE). Transitive fixes: fast-uri, shell-quote, brace-expansion, ip-address, proxy-addr, compression, source-map-js.

6486dde — override table trimmed from 24 entries to 3. Most entries pinned a version the parent's own semver range already allowed; the old lockfile simply hadn't re-resolved. Those entries are keyed to an exact parent version, so they silently stop applying when the parent is bumped, and every vulnerability follow-up had to re-key them. I cleared the table, re-resolved, and added back only what pnpm audit still needed. All 3 survivors are outside the parent's range:

• @rspack/dev-server@1.1.5 pins webpack-dev-server@5.2.2 exactly
• the sockjs tarball (unreleased upstream fix that drops uuid@8)
• concurrently@10.0.5 pins shell-quote@1.9.0 exactly; 1.11.0 is the same major, and concurrently only quote()s plain argv strings

The express 4.x qs issue is now fixed by moving the lockfile to express@4.22.3, which ships qs ~6.16.0 and is within webpack-dev-server's ^4.22.1 range. Other resolution changes from the re-resolve are all in-range and on the dev-server/vite chains: esbuild 0.28.2, @peculiar/asn1-* 2.10.0, pkijs 3.4.1, @noble/hashes 1.8.0. The comment at the top of overrides: records the rule: in-range fixes go through a lockfile refresh.

Remaining: 1 high. braces@3.0.3 via @rspack/cli>@rspack/dev-server>chokidar@3. No patched release exists, and this project never runs rspack serve.

Verified on 6486dde: pnpm install --frozen-lockfile, typecheck, lint:ci and build pass, and CI=1 pnpm run test:ci passes 373 files / 4837 tests.