pixel_pop/UHD_Media_Tool
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ceb66f8c7762b3429258168245becdc95345d1ce
UHD_Media_Tool/docs/plan/evidence/2026-10-01-dependencies/browser-audit.json
T
rootandClaude Opus 5.5 ceb66f8c77 feat: v0.3.8–v0.3.14 工作区汇总（依赖升级、整理来源、手动入库、原地入库等） 
生产 v0.3.8～v0.3.13 均由 8013196 加工作区修改构建部署，此前未提交；本提交补齐源码，
并含未部署的 v0.3.14 原地入库。中间各版本源码状态未保存，无法逐版拆分，详见
docs/plan/17-full-upgrade.md 与 docs/plan/18-organize-release.md。

- v0.3.8 全面升级：Deno workspace 依赖、Router 8 / Vite 8、camofox 1.18.0 / Node 24、
  PostgreSQL 18.6、备份客户端 18.6、演示 qB 5.2.4
- v0.3.9 媒体整理：分类规则、整理来源与目录快照（0059）、文件管理整理入口
- v0.3.10 手动下载与入库：独立手动下载、详情页资源下载、TMDB / Local 元数据兜底
  （metadata.resolve_organize）、正常多版本 / 一次性洗版（0060）
- v0.3.11 搜索详情与桌面黑边修复
- v0.3.12 列表分页、搜索历史、首页概况
- v0.3.13 统一整理弹窗与队列
- v0.3.14 原地入库（0061，未部署）

同批审计修复：
- 刮削入队：确认原记录存在后才删重放产生的新记录；写回 run 关联失败时保持 queued，
  由处理器补关联（对齐 MP 先登记、只在入队失败时记失败）
- 识别升级链只在结果更确定时采用，不再用 no_match 顶替原有歧义候选
- bluray_dir 资产以原盘目录本身为刮削根（MP 同做法）
- metadata.resolve_organize 登记到入库排障 Skill 与能力地图
- db/src/types.ts 按迁移重新生成；contracts 整理动作枚举顺序与数据库对齐
- 测试：原地入库用例改为直接查记录表；domain 测试模板补 version
- 前端：通知铃铛弹层与用户菜单统一样式；站点卡片共用卡头、底栏贴底、分页间距

依赖升级证据只提交摘要文件，registry-snapshot.json 移至 .local/（SHA-256 记于文档）。

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-02 15:47:17 +08:00

354 lines
11 KiB
JSON
Raw Blame History

{
"auditReportVersion": 2,
"vulnerabilities": {
"adm-zip": {
"name": "adm-zip",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1193734,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite",
"url": "https://github.com/advisories/GHSA-vwc7-r8mq-g2x9",
"severity": "moderate",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
},
"range": ">=0.5.9 <=0.6.0"
},
{
"source": 1239030,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)",
"url": "https://github.com/advisories/GHSA-7q85-xj36-vmfc",
"severity": "high",
"cwe": [
"CWE-789"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.6.1"
},
{
"source": 1240032,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0",
"url": "https://github.com/advisories/GHSA-rcw4-f5rp-g42v",
"severity": "high",
"cwe": [
"CWE-409"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.6.0"
},
{
"source": 1240034,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation",
"url": "https://github.com/advisories/GHSA-j5f4-cc29-5x44",
"severity": "high",
"cwe": [
"CWE-732"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
"range": "<=0.6.0"
},
{
"source": 1240064,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content",
"url": "https://github.com/advisories/GHSA-p634-w6r4-rjp2",
"severity": "moderate",
"cwe": [
"CWE-436",
"CWE-696"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<=0.6.0"
},
{
"source": 1240065,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path",
"url": "https://github.com/advisories/GHSA-c6fg-446q-cg94",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-770"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<=0.6.0"
},
{
"source": 1240066,
"name": "adm-zip",
"dependency": "adm-zip",
"title": "adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)",
"url": "https://github.com/advisories/GHSA-8238-w5pm-2374",
"severity": "high",
"cwe": [
"CWE-248",
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.6.0"
}
],
"effects": [],
"range": "<=0.6.0",
"nodes": [
"node_modules/adm-zip"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1240103,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
"url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-407"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <5.0.12"
},
{
"source": 1240107,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <5.0.11"
},
{
"source": 1240111,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <5.0.10"
}
],
"effects": [],
"range": "4.0.0 - 5.0.11",
"nodes": [
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"fast-uri": {
"name": "fast-uri",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1240091,
"name": "fast-uri",
"dependency": "fast-uri",
"title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",
"url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj",
"severity": "moderate",
"cwe": [
"CWE-178"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": ">=3.0.0 <3.1.8"
}
],
"effects": [],
"range": "3.0.0 - 3.1.7",
"nodes": [
"node_modules/fast-uri"
],
"fixAvailable": true
},
"hono": {
"name": "hono",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1240640,
"name": "hono",
"dependency": "hono",
"title": "hono/jsx renders plain strings unescaped in boundary components, leading to XSS",
"url": "https://github.com/advisories/GHSA-hxh3-vqpv-xpqv",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 4.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.13.7"
}
],
"effects": [],
"range": "<4.13.7",
"nodes": [
"node_modules/hono"
],
"fixAvailable": true
},
"ip-address": {
"name": "ip-address",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1239948,
"name": "ip-address",
"dependency": "ip-address",
"title": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",
"url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
"severity": "moderate",
"cwe": [
"CWE-697",
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=10.5.0"
},
{
"source": 1239949,
"name": "ip-address",
"dependency": "ip-address",
"title": "ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass",
"url": "https://github.com/advisories/GHSA-2vr4-cq9g-pvrc",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=10.2.0 <=10.5.0"
},
{
"source": 1240097,
"name": "ip-address",
"dependency": "ip-address",
"title": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",
"url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
"severity": "moderate",
"cwe": [
"CWE-697",
"CWE-843"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=10.7.0"
},
{
"source": 1240098,
"name": "ip-address",
"dependency": "ip-address",
"title": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",
"url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-770"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=10.7.0"
}
],
"effects": [],
"range": "<=10.7.0",
"nodes": [
"node_modules/ip-address"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 3,
"high": 2,
"critical": 0,
"total": 5
},
"dependencies": {
"prod": 171,
"dev": 501,
"optional": 84,
"peer": 1,
"peerOptional": 0,
"total": 680
}
}
}
Reference in new issue View Git Blame Copy Permalink