@usequark/quark-create-app 1.27.4 → 1.27.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -25,13 +25,13 @@
|
|
|
25
25
|
"@usequark/quark-ui": "workspace:*",
|
|
26
26
|
"ioredis": "^6.0.0",
|
|
27
27
|
"jose": "^6.2.12",
|
|
28
|
-
"next": "16.
|
|
28
|
+
"next": "16.4.1",
|
|
29
29
|
"next-auth": "5.0.0-beta.32",
|
|
30
30
|
"pg": "^8.23.0",
|
|
31
31
|
"react": "19.3.0",
|
|
32
32
|
"react-dom": "19.3.0",
|
|
33
33
|
"rrweb": "2.1.6",
|
|
34
|
-
"zod": "^4.6.
|
|
34
|
+
"zod": "^4.6.6"
|
|
35
35
|
},
|
|
36
36
|
"devDependencies": {
|
|
37
37
|
"@tailwindcss/postcss": "^4.3.3",
|
|
@@ -26,10 +26,25 @@ overrides:
|
|
|
26
26
|
# next-auth/providers/nodemailer.
|
|
27
27
|
"next-auth>nodemailer": "-"
|
|
28
28
|
"@auth/core>nodemailer": "-"
|
|
29
|
-
# stripe@17.7.0 declares `qs: ^6.11.0`, so
|
|
30
|
-
# `pnpm update` cannot move it (qs is not a direct dependency
|
|
31
|
-
# package).
|
|
32
|
-
|
|
29
|
+
# stripe@17.7.0 declares `qs: ^6.11.0`, so a current release is inside its
|
|
30
|
+
# own range and `pnpm update` cannot move it (qs is not a direct dependency
|
|
31
|
+
# of any workspace package). The floor tracks the newest advisory:
|
|
32
|
+
# GHSA-g4mx-9h6g-cwc7 / GHSA-hrpp-f998-fjpq needed >=6.16.0, and
|
|
33
|
+
# GHSA-6pq8-jhm2-2vcw (2026-11-09) needs >=6.16.1.
|
|
34
|
+
qs@>=6.14.2 <=6.16.0: ">=6.16.1"
|
|
35
|
+
# node-forge@1.4.0 comes from @expo/cli's tree (`^1.3.3`), so 1.4.1 is
|
|
36
|
+
# inside the declared range - a same-major patch, build-time only (Expo
|
|
37
|
+
# code signing). It clears twelve advisories at once: GHSA-4642/6wvx/525v/
|
|
38
|
+
# 7wch/h6cr/4487/5cwg/jc66/8hrf/hqq3/5x38, plus GHSA-86w9-cpqp-85rv which
|
|
39
|
+
# 1.4.x also fixed - both were retired from the allowlist on 2026-11-09.
|
|
40
|
+
node-forge@<=1.4.0: ">=1.4.1"
|
|
41
|
+
# undici@8.11.2 sits behind dependents that declare ^8.x, so 8.12.2 is
|
|
42
|
+
# inside their ranges - same major, no API change. Clears GHSA-4qv8/f72v/
|
|
43
|
+
# 9fm3/55wc (moderate) and xjj6/qrxm/4w7w/2m5v (high).
|
|
44
|
+
undici@<8.12.2: ">=8.12.2"
|
|
45
|
+
# launch-editor@2.14.1 (vite / Expo dev tooling); GHSA-698v/r825/587h all
|
|
46
|
+
# need >=2.14.2, a same-major patch.
|
|
47
|
+
launch-editor@<=2.14.1: ">=2.14.2"
|
|
33
48
|
# xcode@3.0.1 declares `uuid: ^7.0.3`; GHSA-w5hq-g745-h8pq needs >=11.1.1,
|
|
34
49
|
# four majors ahead. Safe here because xcode only calls uuid.v4() (lib/
|
|
35
50
|
# pbxProject.js), which is unchanged in 11.x, and 11.1.1 still supports
|
|
@@ -40,6 +55,9 @@ overrides:
|
|
|
40
55
|
fast-xml-parser@<5.10.1: ">=5.10.1"
|
|
41
56
|
lodash@>=4.0.0 <=4.17.22: ">=4.17.23"
|
|
42
57
|
hono@<4.12.25: ">=4.12.25"
|
|
43
|
-
fast-uri
|
|
58
|
+
# fast-uri arrives transitively (fastify stack), so `pnpm update` cannot
|
|
59
|
+
# move it either. Floor tracks the newest advisory: GHSA-w74x/wjr9/xhq7/
|
|
60
|
+
# 333x all need >=4.2.3, superseding the earlier >=4.1.4 floor. Same major.
|
|
61
|
+
fast-uri@<4.2.3: ">=4.2.3"
|
|
44
62
|
deepmerge-ts@<8.0.0: ">=8.0.0"
|
|
45
63
|
mysql2@<3.22.0: ">=3.22.0"
|