From 0d852dbbd598d0cce0ef2339c74937de47d2a487 Mon Sep 17 00:00:00 2001 From: Aleksandr Borovskii Date: Mon, 5 Oct 2026 15:44:29 +0200 Subject: [PATCH 1/2] fix(deps): bump @neuralegion/os-service to ^2.0.7 @neuralegion/os-service 2.0.7 bumps its plist dependency to ^3.1.1, which moves @xmldom/xmldom off the vulnerable 0.8.x line to 0.9.12. Bumping it here replaces the single @xmldom/xmldom copy in the tree with 0.9.12 and clears all 10 @xmldom/xmldom alerts. Production webpack build and all 222 unit tests pass. --- package-lock.json | 50 ++++++++++++++++++++++++----------------------- package.json | 2 +- 2 files changed, 27 insertions(+), 25 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2246c8fe..a385fcf1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "dependencies": { "@brightsec/node-libcurl": "5.1.3", "@modelcontextprotocol/sdk": "1.17.5", - "@neuralegion/os-service": "^2.0.6", + "@neuralegion/os-service": "^2.0.7", "@neuralegion/raw-socket": "^2.0.2", "@sentry/node": "^7.120.0", "ajv": "^6.12.6", @@ -2198,15 +2198,15 @@ } }, "node_modules/@neuralegion/os-service": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/@neuralegion/os-service/-/os-service-2.0.6.tgz", - "integrity": "sha512-3JY8s/rXwwUgS7H8U642GlrXDvXLPMkHXkZCG5M06sRS3jzj3S7Tee9eZOwwXrrHtyfjZReOtyLsm2C+ftMOYw==", + "version": "2.0.7", + "resolved": "https://npm.pkg.github.com/download/@NeuraLegion/os-service/2.0.7/1c53e12f92290b0983a206f36a390f84689ebd1f", + "integrity": "sha512-H5DkwIVWinMJeZcHoG5nCOCA2dhpDX7R+0TP15fp5XhRYS0g9FUhEhmlMV+Xy2q1g49uksiP0NKebwk9vQ+JDQ==", "hasInstallScript": true, "license": "MIT", "dependencies": { "nan": "^2.28.0", "node-gyp-build": "^4.8.4", - "plist": "^3.1.0" + "plist": "^3.1.1" }, "engines": { "node": ">=20" @@ -4481,12 +4481,12 @@ } }, "node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.9.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz", + "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==", "license": "MIT", "engines": { - "node": ">=10.0.0" + "node": ">=14.6" } }, "node_modules/@xtuc/ieee754": { @@ -14247,11 +14247,12 @@ } }, "node_modules/plist": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.0.tgz", - "integrity": "sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ==", + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.1.tgz", + "integrity": "sha512-ZIfcLJC+7E7FBFnDxm9MPmt7D+DidyQ26lewieO75AdhA2ayMtsJSES0iWzqJQbcVRSrTufQoy0DR94xHue0oA==", + "license": "MIT", "dependencies": { - "@xmldom/xmldom": "^0.8.8", + "@xmldom/xmldom": "^0.9.10", "base64-js": "^1.5.1", "xmlbuilder": "^15.1.1" }, @@ -17874,6 +17875,7 @@ "version": "15.1.1", "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-15.1.1.tgz", "integrity": "sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==", + "license": "MIT", "engines": { "node": ">=8.0" } @@ -19509,13 +19511,13 @@ } }, "@neuralegion/os-service": { - "version": "2.0.6", - "resolved": "https://registry.npmjs.org/@neuralegion/os-service/-/os-service-2.0.6.tgz", - "integrity": "sha512-3JY8s/rXwwUgS7H8U642GlrXDvXLPMkHXkZCG5M06sRS3jzj3S7Tee9eZOwwXrrHtyfjZReOtyLsm2C+ftMOYw==", + "version": "2.0.7", + "resolved": "https://npm.pkg.github.com/download/@NeuraLegion/os-service/2.0.7/1c53e12f92290b0983a206f36a390f84689ebd1f", + "integrity": "sha512-H5DkwIVWinMJeZcHoG5nCOCA2dhpDX7R+0TP15fp5XhRYS0g9FUhEhmlMV+Xy2q1g49uksiP0NKebwk9vQ+JDQ==", "requires": { "nan": "^2.28.0", "node-gyp-build": "^4.8.4", - "plist": "^3.1.0" + "plist": "^3.1.1" } }, "@neuralegion/raw-socket": { @@ -21045,9 +21047,9 @@ "requires": {} }, "@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==" + "version": "0.9.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz", + "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==" }, "@xtuc/ieee754": { "version": "1.2.0", @@ -27705,11 +27707,11 @@ } }, "plist": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.0.tgz", - "integrity": "sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ==", + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.1.tgz", + "integrity": "sha512-ZIfcLJC+7E7FBFnDxm9MPmt7D+DidyQ26lewieO75AdhA2ayMtsJSES0iWzqJQbcVRSrTufQoy0DR94xHue0oA==", "requires": { - "@xmldom/xmldom": "^0.8.8", + "@xmldom/xmldom": "^0.9.10", "base64-js": "^1.5.1", "xmlbuilder": "^15.1.1" } diff --git a/package.json b/package.json index 94a415a8..c55ef725 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "dependencies": { "@brightsec/node-libcurl": "5.1.3", "@modelcontextprotocol/sdk": "1.17.5", - "@neuralegion/os-service": "^2.0.6", + "@neuralegion/os-service": "^2.0.7", "@neuralegion/raw-socket": "^2.0.2", "@sentry/node": "^7.120.0", "ajv": "^6.12.6", From d81e2da054cf93ef7ae4683f6ae74551246e0487 Mon Sep 17 00:00:00 2001 From: Aleksandr Borovskii Date: Tue, 6 Oct 2026 09:48:38 +0200 Subject: [PATCH 2/2] fix(ci): resolve @neuralegion/os-service from public npm, not GitHub Packages The lockfile recorded @neuralegion/os-service@2.0.7 with a GitHub Packages resolved URL (npm.pkg.github.com), because it was regenerated in an environment whose .npmrc maps the @neuralegion scope to GHP. In CI, npm ci fetches that exact URL and 401s (no GHP token on the e2e runners), unlike every other dependency which resolves from registry.npmjs.org. os-service@2.0.7 is published to public npm too (same integrity), so point the resolved URL there to match @neuralegion/raw-socket and the rest of the tree. Verified: npm ci now succeeds with a token-less public-npm config. --- package-lock.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index a385fcf1..94ec8bdd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2199,7 +2199,7 @@ }, "node_modules/@neuralegion/os-service": { "version": "2.0.7", - "resolved": "https://npm.pkg.github.com/download/@NeuraLegion/os-service/2.0.7/1c53e12f92290b0983a206f36a390f84689ebd1f", + "resolved": "https://registry.npmjs.org/@neuralegion/os-service/-/os-service-2.0.7.tgz", "integrity": "sha512-H5DkwIVWinMJeZcHoG5nCOCA2dhpDX7R+0TP15fp5XhRYS0g9FUhEhmlMV+Xy2q1g49uksiP0NKebwk9vQ+JDQ==", "hasInstallScript": true, "license": "MIT", @@ -19512,7 +19512,7 @@ }, "@neuralegion/os-service": { "version": "2.0.7", - "resolved": "https://npm.pkg.github.com/download/@NeuraLegion/os-service/2.0.7/1c53e12f92290b0983a206f36a390f84689ebd1f", + "resolved": "https://registry.npmjs.org/@neuralegion/os-service/-/os-service-2.0.7.tgz", "integrity": "sha512-H5DkwIVWinMJeZcHoG5nCOCA2dhpDX7R+0TP15fp5XhRYS0g9FUhEhmlMV+Xy2q1g49uksiP0NKebwk9vQ+JDQ==", "requires": { "nan": "^2.28.0",