@unisphere/nx 4.15.1 → 4.15.2

package/dist/migrations/4-15-2/add-critical-security-overrides.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Migration: Add critical security overrides
+ *
+ * Adds npm overrides for critical transitive dependency vulnerabilities:
+ * - websocket-driver (critical): Resource limit bypass via message compression +
+ *   message corruption via abuse of protocol length headers
+ *   Chain: @nx/webpack → webpack-dev-server → sockjs → websocket-driver
+ */
+import { Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;
+//# sourceMappingURL=add-critical-security-overrides.d.ts.map

package/dist/migrations/4-15-2/add-critical-security-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-critical-security-overrides.d.ts","sourceRoot":"","sources":["../../../src/migrations/4-15-2/add-critical-security-overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAsB,MAAM,YAAY,CAAC;AAMtD,wBAA8B,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C9D"}

package/dist/migrations/4-15-2/add-critical-security-overrides.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Migration: Add critical security overrides
+ *
+ * Adds npm overrides for critical transitive dependency vulnerabilities:
+ * - websocket-driver (critical): Resource limit bypass via message compression +
+ *   message corruption via abuse of protocol length headers
+ *   Chain: @nx/webpack → webpack-dev-server → sockjs → websocket-driver
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const SECURITY_OVERRIDES = {
+    'websocket-driver': '>=0.7.5',
+};
+async function update(tree) {
+    devkit_1.logger.info('🔄 Adding security overrides for critical vulnerabilities...');
+    const packageJsonPath = 'package.json';
+    if (!tree.exists(packageJsonPath)) {
+        devkit_1.logger.warn('⚠️ No package.json found, skipping');
+        return;
+    }
+    const added = [];
+    const updated = [];
+    (0, devkit_1.updateJson)(tree, packageJsonPath, (packageJson) => {
+        if (!packageJson.overrides) {
+            packageJson.overrides = {};
+        }
+        for (const [pkg, version] of Object.entries(SECURITY_OVERRIDES)) {
+            if (packageJson.overrides[pkg]) {
+                if (packageJson.overrides[pkg] !== version) {
+                    packageJson.overrides[pkg] = version;
+                    updated.push(`${pkg}@${version}`);
+                }
+            }
+            else {
+                packageJson.overrides[pkg] = version;
+                added.push(`${pkg}@${version}`);
+            }
+        }
+        return packageJson;
+    });
+    if (added.length > 0) {
+        devkit_1.logger.info(`📦 Added overrides: ${added.join(', ')}`);
+    }
+    if (updated.length > 0) {
+        devkit_1.logger.info(`📦 Updated overrides: ${updated.join(', ')}`);
+    }
+    if (added.length === 0 && updated.length === 0) {
+        devkit_1.logger.info('ℹ️ All security overrides already present');
+    }
+    devkit_1.logger.info('✅ Critical security overrides applied');
+}

package/dist/migrations/4-15-2/move-cli-to-dev-dependencies.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Migration: Move @unisphere/cli to devDependencies
+ *
+ * @unisphere/cli is a build/development tool and should not be in production
+ * dependencies. This migration moves it from dependencies to devDependencies,
+ * preserving the existing version.
+ *
+ * This also resolves the critical `decompress` vulnerability from production
+ * audit reports (decompress is a transitive dependency of @unisphere/cli).
+ */
+import { Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;
+//# sourceMappingURL=move-cli-to-dev-dependencies.d.ts.map

package/dist/migrations/4-15-2/move-cli-to-dev-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-cli-to-dev-dependencies.d.ts","sourceRoot":"","sources":["../../../src/migrations/4-15-2/move-cli-to-dev-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAsB,MAAM,YAAY,CAAC;AAItD,wBAA8B,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC9D"}

package/dist/migrations/4-15-2/move-cli-to-dev-dependencies.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Migration: Move @unisphere/cli to devDependencies
+ *
+ * @unisphere/cli is a build/development tool and should not be in production
+ * dependencies. This migration moves it from dependencies to devDependencies,
+ * preserving the existing version.
+ *
+ * This also resolves the critical `decompress` vulnerability from production
+ * audit reports (decompress is a transitive dependency of @unisphere/cli).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const TARGET_PACKAGE = '@unisphere/cli';
+async function update(tree) {
+    devkit_1.logger.info('🔄 Moving @unisphere/cli to devDependencies...');
+    const packageJsonPath = 'package.json';
+    if (!tree.exists(packageJsonPath)) {
+        devkit_1.logger.warn('⚠️ No package.json found, skipping');
+        return;
+    }
+    let moved = false;
+    (0, devkit_1.updateJson)(tree, packageJsonPath, (packageJson) => {
+        // If it's in dependencies, move it to devDependencies
+        if (packageJson.dependencies?.[TARGET_PACKAGE]) {
+            const version = packageJson.dependencies[TARGET_PACKAGE];
+            // Ensure devDependencies exists
+            if (!packageJson.devDependencies) {
+                packageJson.devDependencies = {};
+            }
+            // Move to devDependencies (preserve version)
+            packageJson.devDependencies[TARGET_PACKAGE] = version;
+            delete packageJson.dependencies[TARGET_PACKAGE];
+            moved = true;
+            devkit_1.logger.info(`📦 Moved ${TARGET_PACKAGE}@${version} from dependencies to devDependencies`);
+        }
+        return packageJson;
+    });
+    if (!moved) {
+        devkit_1.logger.info(`ℹ️ ${TARGET_PACKAGE} is not in dependencies (already in devDependencies or not present)`);
+    }
+    devkit_1.logger.info('✅ @unisphere/cli placement verified');
+}

package/migrations.json

@@ -578,6 +578,22 @@
       "cli": {
         "postUpdateMessage": "✅ GitHub Actions upgraded to Node 24-compatible versions"
       }
+    },
+    "4.15.2-add-critical-security-overrides": {
+      "version": "4.15.2",
+      "description": "Adds npm override for websocket-driver critical vulnerability (resource limit bypass + message corruption)",
+      "factory": "./dist/migrations/4-15-2/add-critical-security-overrides.js",
+      "cli": {
+        "postUpdateMessage": "✅ Critical security overrides applied (websocket-driver)"
+      }
+    },
+    "4.15.2-move-cli-to-dev-dependencies": {
+      "version": "4.15.2",
+      "description": "Moves @unisphere/cli from dependencies to devDependencies (build tool, not production dependency)",
+      "factory": "./dist/migrations/4-15-2/move-cli-to-dev-dependencies.js",
+      "cli": {
+        "postUpdateMessage": "✅ @unisphere/cli moved to devDependencies"
+      }
     }
   },
   "packageJsonUpdates": {
@@ -1091,6 +1107,17 @@
           "alwaysAddToPackageJson": false
         }
       }
+    },
+    "4.15.2": {
+      "version": "4.15.2",
+      "cli": "nx",
+      "postUpdateMessage": "🎉 Migration to @unisphere/nx 4.15.2 completed successfully!",
+      "packages": {
+        "@unisphere/cli": {
+          "version": "6.0.3",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unisphere/nx",
-  "version": "4.15.1",
+  "version": "4.15.2",
   "private": false,
   "main": "./dist/index.js",
   "module": "./dist/index.js",