From e9fa5a77015c97b57823e33369eae5d18b269c69 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Fri, 21 Aug 2026 21:48:13 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=8E=A8=20Palette:=20CopyPromptButton?= =?UTF-8?q?=20=EC=A0=91=EA=B7=BC=EC=84=B1=20=EA=B0=9C=EC=84=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit πŸ’‘ What: 포컀슀된 λ²„νŠΌμ˜ 이름이 λ³€ν•  λ•Œ 슀크린 리더가 μƒνƒœλ₯Ό μ˜¬λ°”λ₯΄κ²Œ 읽지 λͺ»ν•˜λŠ” 문제λ₯Ό ν•΄κ²°ν•˜κΈ° μœ„ν•΄ aria-label을 μΆ”κ°€ν•˜κ³ , μ‹€μ œ λ³€κ²½λ˜λŠ” ν…μŠ€νŠΈλŠ” role="status"λ₯Ό 가진 λ³„λ„μ˜ sr-only μ—˜λ¦¬λ¨ΌνŠΈμ—μ„œ μ½νžˆλ„λ‘ κ°œμ„ ν–ˆμŠ΅λ‹ˆλ‹€. 🎯 Why: κΈ°μ‘΄ μ»΄ν¬λ„ŒνŠΈλŠ” aria-live="polite"λ₯Ό μ‚¬μš©ν–ˆμœΌλ‚˜, μ΄λŠ” λ²„νŠΌμ˜ ν…μŠ€νŠΈκ°€ λ°”λ€” λ•Œ 슀크린 λ¦¬λ”μ—κ²Œ μ‹ λ’°ν•  수 μ—†λŠ” κ²½ν—˜μ„ μ£Όμ—ˆκΈ° λ•Œλ¬Έμž…λ‹ˆλ‹€. πŸ“Έ Before/After: μ‹œκ°μ μΈ λ³€ν™”λŠ” μ—†μœΌλ©° ꡬ쑰만 λ³€κ²½λ˜μ—ˆμŠ΅λ‹ˆλ‹€. β™Ώ Accessibility: 이제 슀크린 λ¦¬λ”μ—μ„œ '볡사됨' μƒνƒœλ₯Ό μ‹ λ’°μ„± 있게 μ½μ–΄μ€λ‹ˆλ‹€. --- .Jules/palette.md | 5 +++++ packages/web/src/components/copy-prompt-button.test.tsx | 9 +++++---- packages/web/src/components/copy-prompt-button.tsx | 6 +++++- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.Jules/palette.md b/.Jules/palette.md index 104c1e4b..9f1ae3b3 100644 --- a/.Jules/palette.md +++ b/.Jules/palette.md @@ -9,3 +9,8 @@ ## 2024-11-20 - CopyPromptButton μ ‘κ·Όμ„± ν–₯상 (동적 ν…μŠ€νŠΈ 및 μƒνƒœ) **Learning:** `CopyPromptButton`κ³Ό 같이 λ²„νŠΌμ„ ν΄λ¦­ν–ˆμ„ λ•Œ μ‹œκ°μ μœΌλ‘œλ§Œ μƒνƒœκ°€ λ³€ν•˜κ³ (예: 볡사 μ•„μ΄μ½˜μ΄ 체크 μ•„μ΄μ½˜μœΌλ‘œ λ³€κ²½), ν…μŠ€νŠΈκ°€ λ™μ μœΌλ‘œ λ³€κ²½λ˜λŠ” μ»΄ν¬λ„ŒνŠΈμ—μ„œλŠ” 슀크린 리더 μ‚¬μš©μžκ°€ μƒνƒœ λ³€ν™”λ₯Ό μ•Œμ•„μ±„κΈ° μ–΄λ ΅μŠ΅λ‹ˆλ‹€. λ˜ν•œ 슀크린 리더가 순수 μž₯μ‹μš© μ•„μ΄μ½˜κΉŒμ§€ λΆˆν•„μš”ν•˜κ²Œ 읽을 수 μžˆμŠ΅λ‹ˆλ‹€. **Action:** λ™μ μœΌλ‘œ λ³€κ²½λ˜λŠ” ν…μŠ€νŠΈλ₯Ό ``둜 감싸 슀크린 리더가 μ¦‰μ‹œ λ³€κ²½ 사항을 읽어주도둝 ν•΄μ•Ό ν•©λ‹ˆλ‹€. ` ); } From 53412ae827f7f4eafe450cc26e6c621934c7bead Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Fri, 21 Aug 2026 22:06:49 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20deepmerge-ts=20ReDoS=20vulnerability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🚨 Severity: High πŸ’‘ Vulnerability: deepmerge-ts@7.1.5 has a known ReDoS vulnerability (GHSA-ggr8-5vv4-36mx) via OSV-Scanner/Trivy-fs. 🎯 Impact: An attacker could cause a Denial of Service by providing a deeply nested or circular object. πŸ”§ Fix: Enforced deepmerge-ts@8.0.0 via pnpm overrides in the root package.json to resolve the vulnerability. βœ… Verification: Ran pnpm install and pnpm test to ensure no build regressions. --- .jules/sentinel.md | 5 +++++ package.json | 3 ++- pnpm-lock.yaml | 9 +++++---- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 7902c442..a5135fb1 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -30,3 +30,8 @@ **Vulnerability:** Known high-severity vulnerabilities discovered by the audit in `js-yaml` and `nanoid` packages. **Learning:** Deeply nested dependencies (`js-yaml` via `eslint`, `nanoid` via `vitest/vite`) may expose the application to DoS or logic loops. **Prevention:** Use `pnpm.overrides` in the root `package.json` to enforce patched versions across all transitive paths in a pnpm workspace. + +## 2024-11-21 - deepmerge-ts ReDoS Vulnerability +**Vulnerability:** deepmerge-ts@7.1.5 was vulnerable to ReDoS (Regular Expression Denial of Service) through GHSA-ggr8-5vv4-36mx. +**Learning:** This vulnerability existed in deeply nested dependency trees and was flagged by the strict OSV-Scanner checks in CI. +**Prevention:** Always ensure vulnerabilities in deeply nested dependencies (like deepmerge-ts) are enforced to the patched versions using the `pnpm.overrides` block in the root `package.json` to safely patch them and pass CI checks. diff --git a/package.json b/package.json index d085ba62..3b3196c1 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,8 @@ "undici": "^7.29.0", "minimatch": "^10.0.0", "@hono/node-server": "^2.0.5", - "body-parser": "^2.3.0" + "body-parser": "^2.3.0", + "deepmerge-ts": "8.0.0" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6dfd315f..126f48d9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -22,6 +22,7 @@ overrides: minimatch: ^10.0.0 '@hono/node-server': ^2.0.5 body-parser: ^2.3.0 + deepmerge-ts: 8.0.0 pnpmfileChecksum: qsp27c6veblwg3gxusbbzrumtm @@ -2278,8 +2279,8 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge-ts@7.1.5: - resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==} + deepmerge-ts@8.0.0: + resolution: {integrity: sha512-ICNjaP0ML+eSdEpJYQC46XiAn/UjAdwbEl0dE8p85ZTeNDinN4Kd4+9jS4OSAuH7st6eC7rQhsqTF5zIDaUm2g==} engines: {node: '>=16.0.0'} deepmerge@4.3.1: @@ -5659,7 +5660,7 @@ snapshots: '@prisma/config@6.19.3(magicast@0.3.5)': dependencies: c12: 3.1.0(magicast@0.3.5) - deepmerge-ts: 7.1.5 + deepmerge-ts: 8.0.0 effect: 3.21.0 empathic: 2.0.0 transitivePeerDependencies: @@ -6660,7 +6661,7 @@ snapshots: deep-is@0.1.4: {} - deepmerge-ts@7.1.5: {} + deepmerge-ts@8.0.0: {} deepmerge@4.3.1: {}