From a14bbccf17b27f65f81cdbf051afe24bca8de998 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Wed, 8 Jul 2026 11:31:18 -0300 Subject: [PATCH] chore(deps): bump omniglyph to ^1.0.2 (security: ReDoS fixes) (#6661) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lockfile pinned omniglyph@1.0.0, which carries the polynomial-ReDoS regex paths fixed in 1.0.1/1.0.2 (all upstream CodeQL alerts resolved). Bump the range to ^1.0.2 and refresh the lock so `npm ci` installs 1.0.2. No change to the omniglyph engine behavior — 1.0.1/1.0.2 touched only regex hot paths and docs; the dependency tree is unchanged (gpt-tokenizer ^3.4.0). Co-authored-by: diegosouzapw --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 08d93a3de9..ef4f311e89 100644 --- a/package-lock.json +++ b/package-lock.json @@ -58,7 +58,7 @@ "next-intl": "^4.12.0", "next-themes": "^0.4.6", "node-machine-id": "^1.1.12", - "omniglyph": "^1.0.0", + "omniglyph": "^1.0.2", "open": "^11.0.0", "ora": "^9.4.1", "parse5": "^8.0.1", @@ -22298,9 +22298,9 @@ "license": "MIT" }, "node_modules/omniglyph": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/omniglyph/-/omniglyph-1.0.0.tgz", - "integrity": "sha512-Jz48LVU4UOtQ++kad4Pa5bNqJEqa0OfYRR7iJtsLoMgpNmnAqjAnQao/VIsh2anTurC+BLPhCthzmAjIo746iA==", + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/omniglyph/-/omniglyph-1.0.2.tgz", + "integrity": "sha512-GGLet99n3HVxOx3WuNPda4B0ETptX9SA8h1fnm/AYSXmvsKXE3mN11Ae2jfX8ldAOA/rVJRXHzPhNkXsRHzMsg==", "license": "MIT", "dependencies": { "gpt-tokenizer": "^3.4.0" diff --git a/package.json b/package.json index d3f2b97345..c898b34204 100644 --- a/package.json +++ b/package.json @@ -261,7 +261,7 @@ "next-intl": "^4.12.0", "next-themes": "^0.4.6", "node-machine-id": "^1.1.12", - "omniglyph": "^1.0.0", + "omniglyph": "^1.0.2", "open": "^11.0.0", "ora": "^9.4.1", "parse5": "^8.0.1",