chore: upgrade dependencies with known security vulnerabilities (#9640)

* chore: upgrade dependencies with known security vulnerabilities * Update Node.js version in CI workflow * chore: upgrade additional security dependencies * chore: stabilize yarn.lock path-to-regexp entry * chore: bump minimum version ranges for security-patched dependencies * chore: update CHANGELOG.unreleased.md with security upgrades * chore: revert vite upgrade to 6.4.1 (6.4.2 breaks vue-tsc) * chore: fix vite upgrade and pin vue to 3.5.28
2026-09-12 23:19:48 -05:00 · 2026-04-15 16:56:43 +02:00
parent 1b12aebb47
commit 3e21edad4e
40 changed files with 4063 additions and 4027 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
      - name: Setup Node environment
        uses: actions/setup-node@v4
        with:
-          node-version: '22.3'
+          node-version: '24.14'
          cache: 'yarn'

      - name: Install project dependencies
--- a/@vates/node-vsphere-soap/package.json
+++ b/@vates/node-vsphere-soap/package.json
@@ -12,7 +12,7 @@
  "bugs": "https://github.com/vatesfr/xen-orchestra/issues",
  "dependencies": {
    "@xen-orchestra/log": "^0.7.1",
-    "axios": "^1.8.0",
+    "axios": "^1.15.0",
    "soap": "^1.0.0",
    "soap-cookie": "^0.10.1"
  },
--- a/@xen-orchestra/async-map/package.json
+++ b/@xen-orchestra/async-map/package.json
@@ -28,7 +28,7 @@
    "node": ">=6"
  },
  "dependencies": {
-    "lodash": "^4.17.4"
+    "lodash": "^4.18.0"
  },
  "scripts": {
    "postversion": "npm publish",
--- a/@xen-orchestra/backups-cli/package.json
+++ b/@xen-orchestra/backups-cli/package.json
@@ -12,7 +12,7 @@
    "@xen-orchestra/fs": "^4.7.0",
    "filenamify": "^6.0.0",
    "getopts": "^2.2.5",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0"
  },
  "engines": {
--- a/@xen-orchestra/backups/package.json
+++ b/@xen-orchestra/backups/package.json
@@ -42,7 +42,7 @@
    "golike-defer": "^0.5.1",
    "human-format": "^1.2.0",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.17.20",
+    "lodash": "^4.18.0",
    "moment-timezone": "^0.5.46",
    "ms": "^2.1.3",
    "node-zone": "^0.4.0",
--- a/@xen-orchestra/cron/package.json
+++ b/@xen-orchestra/cron/package.json
@@ -34,7 +34,7 @@
    "node": ">=8.3"
  },
  "dependencies": {
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "moment-timezone": "^0.5.14"
  },
  "scripts": {
--- a/@xen-orchestra/fs/package.json
+++ b/@xen-orchestra/fs/package.json
@@ -37,7 +37,7 @@
    "fs-extra": "^11.1.0",
    "get-stream": "^6.0.0",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "proper-lockfile": "^4.1.2",
    "readable-stream": "^4.1.0",
--- a/@xen-orchestra/lite/package.json
+++ b/@xen-orchestra/lite/package.json
@@ -46,7 +46,7 @@
    "json-rpc-2.0": "^1.7.0",
    "json5": "^2.2.3",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash-es": "^4.17.21",
+    "lodash-es": "^4.18.0",
    "make-error": "^1.3.6",
    "marked": "^15.0.7",
    "minimist": "^1.2.8",
@@ -60,7 +60,7 @@
    "semver": "^7.3.2",
    "typescript": "~5.8.2",
    "unplugin-vue-router": "^0.12.0",
-    "vite": "^6.2.1",
+    "vite": "^6.4.2",
    "vue": "~3.5.13",
    "vue-i18n": "^11.1.2",
    "vue-router": "^4.5.0",
--- a/@xen-orchestra/log/package.json
+++ b/@xen-orchestra/log/package.json
@@ -29,7 +29,7 @@
    "node": ">=8.3"
  },
  "dependencies": {
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0"
  },
  "scripts": {
--- a/@xen-orchestra/mixin/package.json
+++ b/@xen-orchestra/mixin/package.json
@@ -20,7 +20,7 @@
  },
  "dependencies": {
    "bind-property-descriptor": "^2.0.0",
-    "lodash": "^4.17.21"
+    "lodash": "^4.18.0"
  },
  "scripts": {
    "postversion": "npm publish"
--- a/@xen-orchestra/mixins/package.json
+++ b/@xen-orchestra/mixins/package.json
@@ -25,7 +25,7 @@
    "@xen-orchestra/log": "^0.7.1",
    "acme-client": "^5.0.0",
    "app-conf": "^3.0.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "xo-common": "^0.9.0"
  },
--- a/@xen-orchestra/proxy/package.json
+++ b/@xen-orchestra/proxy/package.json
@@ -54,7 +54,7 @@
    "koa": "^2.5.1",
    "koa-compress": "^5.0.1",
    "koa-helmet": "^6.1.0",
-    "lodash": "^4.17.10",
+    "lodash": "^4.18.0",
    "node-zone": "^0.4.0",
    "parse-pairs": "^2.0.0",
    "promise-toolbox": "^0.21.0",
--- a/@xen-orchestra/rest-api/package.json
+++ b/@xen-orchestra/rest-api/package.json
@@ -43,7 +43,7 @@
    "golike-defer": "^0.5.1",
    "inversify": "^6.2.2",
    "inversify-binding-decorators": "^4.0.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "semver": "^7.7.2",
    "swagger-ui-express": "^5.0.1",
--- a/@xen-orchestra/template/package.json
+++ b/@xen-orchestra/template/package.json
@@ -18,7 +18,7 @@
    "node": ">=6"
  },
  "dependencies": {
-    "lodash": "^4.17.15"
+    "lodash": "^4.18.0"
  },
  "scripts": {
    "postversion": "npm publish --access public",
--- a/@xen-orchestra/upload-ova/package.json
+++ b/@xen-orchestra/upload-ova/package.json
@@ -37,7 +37,7 @@
    "get-stream": "^6.0.0",
    "http-request-plus": "^1.0.0",
    "human-format": "^1.0.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "pretty-ms": "^7.0.0",
    "progress-stream": "^2.0.0",
    "pw": "^0.0.4",
--- a/@xen-orchestra/vmware-explorer/package.json
+++ b/@xen-orchestra/vmware-explorer/package.json
@@ -9,7 +9,7 @@
    "@vates/read-chunk": "^1.2.1",
    "@vates/task": "^0.6.2",
    "@xen-orchestra/log": "^0.7.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "semver": "^7.7.2",
    "undici": "^7.8.0",
    "vhd-lib": "^4.15.0",
--- a/@xen-orchestra/web-core/package.json
+++ b/@xen-orchestra/web-core/package.json
@@ -27,7 +27,7 @@
    "echarts": "^5.6.0",
    "human-format": "^1.2.1",
    "iterable-backoff": "^0.1.0",
-    "lodash-es": "^4.17.21",
+    "lodash-es": "^4.18.0",
    "ndjson-readablestream": "^1.3.0",
    "placement.js": "^1.0.0-beta.5",
    "simple-icons": "^14.14.0",
--- a/@xen-orchestra/web/package.json
+++ b/@xen-orchestra/web/package.json
@@ -36,7 +36,7 @@
    "complex-matcher": "^1.1.0",
    "d3-time-format": "^4.1.0",
    "human-format": "^1.2.1",
-    "lodash-es": "^4.17.21",
+    "lodash-es": "^4.18.0",
    "ndjson-readablestream": "^1.3.0",
    "npm-run-all2": "^7.0.2",
    "pinia": "^3.0.1",
@@ -48,7 +48,7 @@
    "universal-cookie": "^7.2.2",
    "unplugin-vue-router": "^0.12.0",
    "value-matcher": "^0.2.0",
-    "vite": "^6.2.1",
+    "vite": "^6.4.2",
    "vue": "~3.5.13",
    "vue-i18n": "^11.1.2",
    "vue-router": "^4.5.0",
--- a/@xen-orchestra/xapi/package.json
+++ b/@xen-orchestra/xapi/package.json
@@ -37,7 +37,7 @@
    "golike-defer": "^0.5.1",
    "http-request-plus": "^1.0.0",
    "json-rpc-protocol": "^0.13.2",
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "vhd-lib": "^4.15.0",
    "xo-common": "^0.9.0"
--- a/CHANGELOG.unreleased.md
+++ b/CHANGELOG.unreleased.md
@@ -7,6 +7,23 @@

 > Security fixes and new features should go in this section

+- [@vates/node-vsphere-soap] Update axios, follow-redirects (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/backups] Update tar (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/fs] Update fast-xml-parser (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/lite] Update lodash-es, vite, rollup (transitive), postcss (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/mcp] Update hono (transitive), @hono/node-server (transitive), express-rate-limit (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/mixins] Update node-forge (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/proxy] Update koa (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/rest-api] Update @hapi/content (transitive), path-to-regexp (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/vmware-explorer] Update undici (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/web] Update lodash-es, vite (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [@xen-orchestra/web-core] Update lodash-es (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [Packages] Update lodash, picomatch (transitive), minimatch (transitive), ajv (transitive), bn.js (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [xen-api] Update undici, basic-ftp (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [xo-server] Update fast-xml-parser, pug (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [xo-server-auth-saml] Update @xmldom/xmldom (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+- [xo-web] Update immutable, pug (transitive), postcss (transitive) (PR [#9640](https://github.com/vatesfr/xen-orchestra/pull/9640))
+
 ### Enhancements

 > Users must be able to say: "Nice enhancement, I'm eager to test it"
@@ -40,11 +57,50 @@

 <!--packages-start-->

+- @vates/async-each patch
+- @vates/generator-toolbox patch
+- @vates/nbd-client minor
+- @vates/node-vsphere-soap patch
+- @vates/types minor
+- @xen-orchestra/async-map patch
+- @xen-orchestra/backups minor
+- @xen-orchestra/backups-cli patch
+- @xen-orchestra/cron patch
+- @xen-orchestra/disk-cli major
+- @xen-orchestra/disk-transform patch
+- @xen-orchestra/fs minor
+- @xen-orchestra/immutable-backups major
+- @xen-orchestra/log patch
 - @xen-orchestra/mcp minor
+- @xen-orchestra/mixin patch
+- @xen-orchestra/mixins patch
+- @xen-orchestra/proxy patch
+- @xen-orchestra/qcow2 minor
 - @xen-orchestra/rest-api minor
+- @xen-orchestra/template patch
+- @xen-orchestra/upload-ova patch
+- @xen-orchestra/vmware-explorer minor
 - @xen-orchestra/web minor
 - @xen-orchestra/web-core minor
+- @xen-orchestra/xapi patch
+- complex-matcher patch
+- vhd-cli patch
+- vhd-lib minor
+- xapi-explore-sr patch
+- xen-api patch
+- xo-cli patch
+- xo-collection patch
+- xo-common patch
+- xo-lib patch
+- xo-remote-parser patch
+- xo-server minor
+- xo-server-backup-reports patch
+- xo-server-load-balancer patch
+- xo-server-netbox patch
 - xo-server-openmetrics minor
- xo-web patch
+- xo-server-sdn-controller patch
+- xo-server-usage-report patch
+- xo-vmdk-to-vhd patch
+- xo-web minor

 <!--packages-end-->
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
    "handlebars": "^4.7.6",
    "husky": "^8.0.2",
    "lint-staged": "^15.0.2",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "prettier": "^3.0.1",
    "promise-toolbox": "^0.21.0",
    "semver": "^7.3.6",
--- a/packages/complex-matcher/package.json
+++ b/packages/complex-matcher/package.json
@@ -24,7 +24,7 @@
    "node": ">=6"
  },
  "dependencies": {
-    "lodash": "^4.17.4"
+    "lodash": "^4.18.0"
  },
  "scripts": {
    "postversion": "npm publish",
--- a/packages/vhd-cli/package.json
+++ b/packages/vhd-cli/package.json
@@ -29,7 +29,7 @@
    "exec-promise": "^0.7.0",
    "getopts": "^2.2.3",
    "human-format": "^1.0.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "uuid": "^9.0.0",
    "vhd-lib": "^4.15.0"
--- a/packages/vhd-lib/package.json
+++ b/packages/vhd-lib/package.json
@@ -26,7 +26,7 @@
    "decorator-synchronized": "^0.6.0",
    "fs-extra": "^11.1.0",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0",
    "readable-stream": "^4.1.0",
    "struct-fu": "^1.2.0",
--- a/packages/xapi-explore-sr/package.json
+++ b/packages/xapi-explore-sr/package.json
@@ -38,7 +38,7 @@
    "chalk": "^4.1.0",
    "exec-promise": "^0.7.0",
    "human-format": "^1.0.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "pw": "^0.0.4",
    "xen-api": "^4.7.6"
  },
--- a/packages/xen-api/package.json
+++ b/packages/xen-api/package.json
@@ -45,7 +45,7 @@
    "jest-diff": "^29.0.3",
    "json-rpc-protocol": "^0.13.1",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "make-error": "^1.3.0",
    "minimist": "^1.2.0",
    "ms": "^2.1.1",
@@ -60,7 +60,7 @@
    "getopts": "^2.3.0",
    "golike-defer": "^0.5.1",
    "human-format": "^1.2.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "process-top": "^1.2.0",
    "progress-stream": "^2.0.0",
    "promise-toolbox": "^0.21.0",
--- a/packages/xo-cli/package.json
+++ b/packages/xo-cli/package.json
@@ -36,7 +36,7 @@
    "getopts": "^2.3.0",
    "http-request-plus": "^1.0.0",
    "human-format": "^1.0.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "micromatch": "^4.0.2",
    "pretty-ms": "^8.0.0",
    "progress-stream": "^2.0.0",
--- a/packages/xo-collection/package.json
+++ b/packages/xo-collection/package.json
@@ -22,7 +22,7 @@
  },
  "dependencies": {
    "kindof": "^2.0.0",
-    "lodash": "^4.17.2",
+    "lodash": "^4.18.0",
    "make-error": "^1.0.2"
  },
  "devDependencies": {
--- a/packages/xo-common/package.json
+++ b/packages/xo-common/package.json
@@ -19,7 +19,7 @@
    "node": ">=6"
  },
  "dependencies": {
-    "lodash": "^4.16.6",
+    "lodash": "^4.18.0",
    "make-error": "^1.2.1"
  },
  "scripts": {
--- a/packages/xo-lib/package.json
+++ b/packages/xo-lib/package.json
@@ -30,7 +30,7 @@
  },
  "dependencies": {
    "jsonrpc-websocket-client": "^0.7.2",
-    "lodash": "^4.17.2",
+    "lodash": "^4.18.0",
    "make-error": "^1.0.4"
  },
  "devDependencies": {
--- a/packages/xo-remote-parser/package.json
+++ b/packages/xo-remote-parser/package.json
@@ -21,7 +21,7 @@
    "node": ">=6"
  },
  "dependencies": {
-    "lodash": "^4.13.1",
+    "lodash": "^4.18.0",
    "url-parse": "^1.4.7"
  },
  "devDependencies": {
--- a/packages/xo-server-backup-reports/package.json
+++ b/packages/xo-server-backup-reports/package.json
@@ -36,7 +36,7 @@
    "@xen-orchestra/log": "^0.7.1",
    "handlebars": "^4.7.8",
    "human-format": "^1.0.0",
-    "lodash": "^4.13.1",
+    "lodash": "^4.18.0",
    "mjml": "^4.15.3",
    "moment-timezone": "^0.5.13"
  },
--- a/packages/xo-server-load-balancer/package.json
+++ b/packages/xo-server-load-balancer/package.json
@@ -30,7 +30,7 @@
    "@xen-orchestra/cron": "^1.0.6",
    "@xen-orchestra/log": "^0.7.1",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.16.2"
+    "lodash": "^4.18.0"
  },
  "devDependencies": {
    "@babel/cli": "^7.0.0",
--- a/packages/xo-server-netbox/package.json
+++ b/packages/xo-server-netbox/package.json
@@ -31,7 +31,7 @@
  "dependencies": {
    "@xen-orchestra/log": "^0.7.1",
    "ipaddr.js": "^2.0.1",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.0",
    "semver": "^7.3.5"
  },
  "devDependencies": {
--- a/packages/xo-server-sdn-controller/package.json
+++ b/packages/xo-server-sdn-controller/package.json
@@ -33,7 +33,7 @@
    "@xen-orchestra/log": "^0.7.1",
    "@xen-orchestra/openflow": "^0.1.3",
    "ipaddr.js": "^2.0.1",
-    "lodash": "^4.17.11",
+    "lodash": "^4.18.0",
    "node-openssl-cert": "^0.1.34",
    "promise-toolbox": "^0.21.0",
    "uuid": "^9.0.0"
--- a/packages/xo-server-usage-report/package.json
+++ b/packages/xo-server-usage-report/package.json
@@ -36,7 +36,7 @@
    "handlebars": "^4.0.6",
    "html-minifier": "^4.0.0",
    "human-format": "^1.0.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "promise-toolbox": "^0.21.0"
  },
  "devDependencies": {
--- a/packages/xo-server/package.json
+++ b/packages/xo-server/package.json
@@ -103,7 +103,7 @@
    "kindof": "^2.0.0",
    "level-party": "^5.0.0",
    "limit-concurrency-decorator": "^0.6.0",
-    "lodash": "^4.17.4",
+    "lodash": "^4.18.0",
    "make-error": "^1",
    "memorystore": "^1.6.2",
    "micromatch": "^4.0.2",
--- a/packages/xo-vmdk-to-vhd/package.json
+++ b/packages/xo-vmdk-to-vhd/package.json
@@ -21,7 +21,7 @@
    "node": ">=12.3"
  },
  "dependencies": {
-    "lodash": "^4.17.15",
+    "lodash": "^4.18.0",
    "pako": "^2.0.4",
    "promise-toolbox": "^0.21.0",
    "tar-stream": "^3.1.6",
--- a/packages/xo-web/package.json
+++ b/packages/xo-web/package.json
@@ -79,7 +79,7 @@
    "js-cookie": "2.2.1",
    "jsonrpc-websocket-client": "^0.7.2",
    "kindof": "^2.0.0",
-    "lodash": "^4.6.1",
+    "lodash": "^4.18.0",
    "loose-envify": "^1.1.0",
    "make-error": "^1.3.2",
    "marked": "^15.0.7",
--- a/yarn.lock
+++ b/yarn.lock