website/pnpm-workspace.yaml
Rama main · réplica de lectura del repositorio original.
# pnpm 11 only reads overrides and build-script allow-lists from this
# file. The legacy `pnpm.overrides` and `pnpm.onlyBuiltDependencies`
# blocks in package.json are silently ignored after pnpm v11.
overrides:
# GHSA-m5mm-p8h7-m29v (CVE-2026-115897): serialize-javascript <7.1.3
# leaves `</script` unescaped at the end of a serialized function
# body, an XSS wherever the output is inlined into a page; fixed in
# 7.1.3. Supersedes the earlier >=7.0.5 floor for GHSA-76p7-773f-r4q5
# (XSS via crafted Object.prototype payloads). Pulled transitively
# through the Docusaurus webpack plugins; not a direct dep.
serialize-javascript: ">=7.1.3"
# CVE-2026-69153 (GHSA-fxqj-rqcc-2cmp): postcss <8.5.23 still reads
# arbitrary `.map` files from an attacker-controlled
# sourceMappingURL when `from` is unset, an incomplete fix of
# GHSA-6g55-p6wh-862q. Supersedes the earlier >=8.5.18 floor for
# GHSA-r28c-9q8g-f849 (same auto-loader, path traversal) and the
# >=8.5.10 floor for CVE-2026-41305 (GHSA-qx2v-qp2m-jg93, XSS via
# unescaped </style> in stringify output). Transitive via
# @docusaurus/core.
postcss: ">=8.5.23"
# uuid <14.0.0 floor for a single resolved major across the tree;
# multiple Docusaurus transitives still pin older 9.x/10.x lines.
uuid: ">=14.0.0"
# GHSA-rwhq-pwvg-2vrg: @babel/plugin-transform-modules-systemjs
# 7.12.0..=7.29.3 can generate arbitrary code when compiling
# malicious input. Transitive via @docusaurus/core > @babel.
"@babel/plugin-transform-modules-systemjs": ">=7.29.4"
# fast-uri <3.1.9 carries five advisories: GHSA-hrr3-gc8f-f4qj
# (CVE-2026-86472, inconsistent host case normalisation via
# percent-encoded octets, fixed in 3.1.8) and four fixed in 3.1.9,
# GHSA-w74x-v6f9-j3xg (CVE-2026-110306, scheme spoofing via
# percent-encoded scheme decoding), GHSA-wjr9-j795-jxcr
# (CVE-2026-110180, host confusion via unchecked WHATWG host
# canonicalisation), GHSA-xhq7-xmqj-769h (CVE-2026-110095, path
# equivalence in relative reference normalisation), and
# GHSA-333x-w4r6-6crp (CVE-2026-110725, scheme injection via an
# unescaped first-segment colon). Supersedes the earlier >=3.1.6
# floor for CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, and
# CVE-2026-76172, the >=3.1.5 floor for CVE-2026-18446
# (GHSA-7p8r-x3mc-p8w7), and the >=3.1.4 floor before it that cleared
# GHSA-86c8-pmm6-93fp, CVE-2026-13676, and CVE-2026-16221.
# Transitive via @docusaurus/core > webpack > schema-utils > ajv.
# Held to the 3.x line expected by ajv.
fast-uri: ">=3.1.9 <4"
# image-size <=2.0.2 carries two infinite-loop DoS advisories, both
# fixed in 2.0.3: GHSA-w3rx-r6r6-pgpr (ICNS parser) and
# GHSA-5p2g-fcmc-qvqq (JXL and HEIF parsers). Transitive via
# @docusaurus/core > @docusaurus/mdx-loader; runs only while the
# docs site builds.
image-size: ">=2.0.3"
# mermaid <11.16.1 carries five advisories, all fixed in 11.16.1:
# GHSA-3rrr-jr9j-h3q3 (prototype pollution through Architecture
# diagrams), GHSA-rhh3-jpg6-66xh (DoS via radar diagrams),
# GHSA-6x64-9x62-f2gx (CSS injection reaching siblings of the
# diagram), GHSA-2v8p-3f2j-5mp7 (infinite-loop DoS in XY charts),
# and GHSA-c4c3-pg64-4m4v (prototype pollution via the configuration
# APIs). Supersedes the earlier >=11.15.0 floor that cleared the
# classDef, classDefs, configuration, and Gantt sanitisation alerts.
# Transitive via @docusaurus/theme-mermaid.
mermaid: ">=11.16.1"
# webpack-dev-server <=5.2.5 carries GHSA-m28w-2pqf-7qgj (DoS via a
# malformed Host or Origin header) and GHSA-f5vj-f2hx-8m93 (CSRF
# through internal developer endpoints), both fixed in 5.2.6;
# supersedes the earlier GHSA-mx8g-39q3-5c79 <5.2.5 floor.
# Transitive via @docusaurus/core; only active during `pnpm start`.
webpack-dev-server: ">=5.2.6 <6"
# CVE-2026-48779 (GHSA-96hv-2xvq-fx4p): ws >=8.0.0 <8.21.0 allows a
# memory-exhaustion DoS from a flood of tiny WebSocket fragments;
# supersedes the earlier CVE-2026-45736 <8.20.1 floor. Transitive
# via @docusaurus/core > webpack-dev-server and
# webpack-bundle-analyzer.
ws: ">=8.21.0"
# GHSA-pqg4-j6r4-53mv (CVE-2026-102422): shell-quote <1.11.0 lets a
# line terminator inside a token through quote(), enabling command
# injection when the output is handed to a shell; fixed in 1.11.0.
# Supersedes the earlier >=1.8.4 floor for CVE-2026-9277
# (GHSA-w7jw-789q-3m8p, newlines left unescaped by quote()).
# Transitive via @docusaurus/core > webpack-dev-server >
# launch-editor. Held to the 1.x line launch-editor declares.
shell-quote: ">=1.11.0 <2"
# undici <7.30.1 carries the advisories fixed across 7.29.1 and
# 7.30.1, among them two TLS certificate-validation bypasses
# (GHSA-2m5v-pch6-74hx, CVE-2026-109383; GHSA-w293-vg96-wgc3,
# CVE-2026-84961), cache poisoning across origins on redirects
# (GHSA-4w7w-5xrc-9h26, CVE-2026-109829), DoS via TLS 1.2
# renegotiation (GHSA-qrxm-fqhp-jwvm) and via excessive
# content-encodings (GHSA-xjj6-f33q-929c), and a WebSocket
# subprotocol DoS (GHSA-rfgv-xxqx-mfg5), plus medium and low issues
# fixed in the same releases. Supersedes the earlier >=7.29.0 floor
# for CVE-2026-13697, CVE-2026-14643, CVE-2026-15157, CVE-2026-16728,
# and CVE-2026-16729, and the >=7.28.0 floor before it that cleared
# GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q, and GHSA-hm92-r4w5-c3mj.
# Transitive via @easyops-cn/docusaurus-search-local > cheerio. Held
# to the 7.x line since nothing in the tree needs undici 8.
undici: ">=7.30.1 <8"
# dompurify <3.4.17 carries GHSA-cg2g-xh64-v4q7 (critical: split
# template expressions survive SAFE_FOR_TEMPLATES in an attached
# shadow root) and GHSA-mrv2-3pqr-j5jr (an IN_PLACE hook that removes
# a parent or sibling leaves the detached subtree's event handlers),
# plus the low-severity GHSA-c6gr-qvv4-5v3f, GHSA-6688-9rhm-gjv2, and
# GHSA-p98j-92pf-mc4p, all fixed by 3.4.17. Supersedes the earlier
# >=3.4.13 floor for GHSA-55q2-fjhq-7xh7, the >=3.4.12 floor for
# GHSA-c2j3-45gr-mqc4, and the >=3.4.11 floor before them that
# cleared the eight-advisory sanitizer-bypass cluster
# (GHSA-x4vx-rjvf-j5p4, GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr,
# GHSA-rp9w-3fw7-7cwq, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676,
# GHSA-76mc-f452-cxcm, GHSA-cmwh-pvxp-8882).
# Transitive via @docusaurus/theme-mermaid > mermaid.
dompurify: ">=3.4.17 <4"
# GHSA-4x5r-pxfx-6jf8: @babel/core <7.29.1 can read arbitrary files
# through a crafted sourceMappingURL comment during compilation.
# Transitive via @docusaurus/core > @docusaurus/babel.
"@babel/core": ">=7.29.1 <8"
# GHSA-64mm-vxmg-q3vj: http-proxy-middleware <2.0.10 matches its
# router by host+path substring, letting a crafted Host header reach
# an unintended backend. Transitive via @docusaurus/core >
# webpack-dev-server; only active during `pnpm start`.
http-proxy-middleware: ">=2.0.10 <3"
# GHSA-4528-x5fx-h6hg (CVE-2026-118772): joi <17.13.9 splits
# string().email({ multiple: true }) input in quadratic time, a DoS,
# fixed in 17.13.9. Supersedes the earlier >=17.13.6 floor for the
# prototype-pollution pair GHSA-gg4h-3hg2-grpc (CVE-2026-84367) and
# GHSA-6w3j-5fw6-r9vr (CVE-2026-84368), and the >=17.13.4 floor
# before it for GHSA-q7cg-457f-vx79 (uncaught RangeError on deeply
# nested input through recursive link() schemas). Transitive via
# @docusaurus/core > @docusaurus/utils > @docusaurus/types.
joi: ">=17.13.9 <18"
# CVE-2026-84375: js-yaml denial of service in YAML parsing, fixed in
# 3.15.2 and 4.3.2; supersedes the earlier >=3.15.1 and >=4.3.1
# floors for CVE-2026-59870 (GHSA-5p4m-2wfm-xmqj, quadratic CPU
# consumption resolving !!omap) and the >=3.15.0 and >=4.1.2 floors
# before them that cleared GHSA-h67p-54hq-rp68 (quadratic-complexity
# DoS in merge-key handling via repeated aliases). Two lines resolve
# in the tree: gray-matter pins js-yaml 3 (kept on the 3.x fix so its
# safeLoad API survives) and Docusaurus build tooling pulls js-yaml 4.
"js-yaml@3": ">=3.15.2 <4"
"js-yaml@4": ">=4.3.2 <5"
# launch-editor <2.14.2 carries three advisories, all fixed in
# 2.14.2: GHSA-587h-7wmj-h5pm (CVE-2026-112942, existence check
# bypassable on Windows), GHSA-r825-w8mm-5pxw (CVE-2026-112944, an
# editor CLI flag misread as an argument, allowing command
# execution), and GHSA-698v-4r3x-3vcv (CVE-2026-112943,
# escapeCmdArgs() leaves `%` unescaped on Windows). Supersedes the
# earlier >=2.14.1 floor for GHSA-v6wh-96g9-6wx3 (NTLMv2 hash leak
# through UNC paths). Transitive via @docusaurus/core >
# webpack-dev-server; only active during `pnpm start`.
launch-editor: ">=2.14.2 <3"
# CVE-2026-67213: nanoid <3.3.17 spins in an infinite loop generating
# random IDs, a DoS reachable from whatever feeds it a size. Held to
# the 3.x line that postcss 8 declares; the other fix, 5.1.6, is
# ESM-only. Transitive via @docusaurus/core > postcss.
nanoid: ">=3.3.17 <4"
# GHSA-6pq8-jhm2-2vcw (CVE-2026-110816): qs <=6.16.0 throws an
# uncaught TypeError from stringify with arrayFormat 'comma' when an
# array element carries a non-callable own toString, a DoS; fixed in
# 6.16.1. Supersedes the earlier >=6.16.0 floor for
# GHSA-4mjr-xmp4-gh2g (CVE-2026-82417, DoS through an
# attacker-controlled isBuffer reached from stringify) and
# GHSA-x5fp-wj9c-mxmx (CVE-2026-82562, the array limit bypassed by
# comma parsing of bracket keys), and the >=6.15.2 floor before it
# for GHSA-q8mj-m7cp-5q26 (TypeError DoS on null/undefined entries in
# comma-format arrays when encodeValuesOnly is set). Transitive via
# @docusaurus/core > webpack-dev-server > express > body-parser;
# only active during `pnpm start`.
qs: ">=6.16.1 <7"
# GHSA-27r3-jxmh-p828 (CVE-2026-111181): body-parser <1.20.9 can be
# driven into a DoS by trailing bytes after a compressed request
# body, fixed in 1.20.9. Supersedes the earlier >=1.20.6 floor for
# GHSA-v422-hmwv-36x6 (size enforcement silently disabled by an
# invalid `limit`). Transitive via @docusaurus/core >
# webpack-dev-server > express; only active during `pnpm start`.
# Held to the 1.x line that express 4 declares.
body-parser: ">=1.20.9 <2"
# websocket-driver <0.7.5 carries two advisories, both fixed in
# 0.7.5: GHSA-xv26-6w52-cph6 (CVE-2026-54466, message corruption by
# abusing protocol length headers) and GHSA-mp7j-qc5w-4988
# (CVE-2026-54490, resource-limit bypass via message compression).
# Transitive via @docusaurus/core > webpack-dev-server > sockjs >
# faye-websocket; only active during `pnpm start`. Held to the 0.7
# line because sockjs 0.3.24 declares ^0.7.4.
websocket-driver: ">=0.7.5 <0.8"
# brace-expansion 1.x carries three DoS advisories, all fixed on the
# v1 maintenance line by 1.1.21: GHSA-6j4f-fj2g-mc7p
# (CVE-2026-102276, uncontrolled recursion in parseCommaParts,
# <1.1.19), GHSA-qhr7-859c-m2p7 (CVE-2026-102278, uncontrolled
# recursion on nested brace groups, <1.1.20), and GHSA-q2hr-2g5m-vwhr
# (CVE-2026-102277, quadratic-time `{a},b}` rewrite, <1.1.21).
# Supersedes the earlier >=1.1.18 floor for CVE-2026-13149,
# CVE-2026-14257, and CVE-2026-69152. Transitive via the many
# minimatch 3.x consumers in the webpack toolchain. Held to the 1.x
# line because minimatch 3 declares ^1.1.7 and 5.x replaced the
# CommonJS default export with a named one.
"brace-expansion@1": ">=1.1.21 <2"
# GHSA-wq5f-xc86-pv6w: sharp <0.35.5 bundles a librsvg build subject
# to CVE-2026-96889, fixed in 0.35.5. Supersedes the earlier >=0.35.4
# floor for GHSA-rgj7-g3m4-5g8c (libheif builds subject to
# GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545) and the >=0.35.0 floor
# before it for GHSA-f88m-g3jw-g9cj (libvips builds subject to
# CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and
# CVE-2026-35591). Transitive via @docusaurus/plugin-ideal-image >
# responsive-loader; only used at build time to resize doc images.
sharp: ">=0.35.5 <0.36"
# CVE-2026-84370: svgo <3.3.5 lets executable links through
# removeScripts via namespace and control-character bypasses, fixed
# in 3.3.5; supersedes the earlier >=3.3.4 floor for
# GHSA-2p49-hgcm-8545 (executable scripts left intact despite the
# removeScripts plugin). Transitive via @docusaurus/core >
# @svgr/webpack and cssnano > postcss-svgo. Held to the 3.x line
# declared by both consumers.
svgo: ">=3.3.5 <4"
# GHSA-2wm5-q62r-hmrv (CVE-2026-85062): colord <2.9.4 rejects
# oversized malformed colour strings slowly enough to be a DoS.
# Transitive via @docusaurus/core > cssnano > postcss-colormin and
# postcss-minify-gradients; only used at build time to minify CSS.
colord: ">=2.9.4"
# GHSA-vc2v-76pw-4v95 (CVE-2026-87776): compression <1.8.2 leaks
# memory when a response closes early, a DoS, fixed in 1.8.2.
# Transitive via @docusaurus/core > webpack-dev-server; only active
# during `pnpm start`.
compression: ">=1.8.2 <2"
# follow-redirects <1.16.2 can carry credential headers across
# redirects: GHSA-8r9p-f939-6h3c (CVE-2026-111755, sensitiveHeaders
# regex escaping) and GHSA-q3jh-wrc6-jgq8 (CVE-2026-111756,
# array-form headers bypassing cross-origin stripping), fixed in
# 1.16.1, and GHSA-mrwp-f3q8-3g9p (CVE-2026-116689, cross-realm
# sensitiveHeaders arrays discarded), fixed in 1.16.2. Transitive via
# webpack-dev-server > http-proxy-middleware > http-proxy; only
# active during `pnpm start`.
follow-redirects: ">=1.16.2 <2"
# GHSA-jqcg-44mw-7w3h (CVE-2026-90711): proxy-addr <2.0.8 can be
# spoofed through an IPv4-mapped IPv6 trust subnet, fixed in 2.0.8.
# Transitive via @docusaurus/core > webpack-dev-server > express;
# only active during `pnpm start`.
proxy-addr: ">=2.0.8 <3"
# GHSA-68fv-2mgg-jv7q (CVE-2026-93749): source-map-js <1.2.2 can
# stall the event loop through indexed source-map section offsets,
# fixed in 1.2.2. Transitive via postcss, and via svgo > csso and
# css-tree.
source-map-js: ">=1.2.2 <2"
# GHSA-g84c-rxfj-3j2c (CVE-2026-76844): webpack-dev-middleware path
# traversal through a public path without a trailing slash, fixed in
# 7.4.6 on the 7.x line. Transitive via @docusaurus/core >
# webpack-dev-server; only active during `pnpm start`.
webpack-dev-middleware: ">=7.4.6 <8"
# GHSA-rj75-hqrm-r3gf (CVE-2026-104844): postcss-selector-parser
# parses flat selectors in quadratic time, a CPU-exhaustion DoS,
# fixed in 6.1.5 and 7.1.6. Both lines resolve in the tree: the
# cssnano 6 plugins declare ^6.0.x and the newer postcss plugins
# declare ^7.0.0.
"postcss-selector-parser@6": ">=6.1.5 <7"
"postcss-selector-parser@7": ">=7.1.6 <8"
# tinypool <2.1.2 lets prototype pollution in worker or run() options
# reach code execution: GHSA-5gmw-xhrv-c9v3 (CVE-2026-104848, fixed
# in 2.1.1) and GHSA-85c8-ppgw-ccpr (CVE-2026-104849, fixed in
# 2.1.2). No 1.x release carries the fix, so this lifts
# @docusaurus/core past its ^1.0.2 range; 2.0 only dropped Node 18,
# and Docusaurus loads it through import() for its SSG worker pool.
tinypool: ">=2.1.2 <3"
# pnpm 11 replaces `onlyBuiltDependencies` with an explicit allow-map.
# Each entry permits the named package's install scripts to run;
# everything else is blocked by default.
allowBuilds:
"@swc/core": true
core-js: true
sharp: true