From 4fdcd1c974d65d0e19661f4b40800b749fb4ae9b Mon Sep 17 00:00:00 2001
From: Victor Nogueira <felladrin@gmail.com>
Date: Tue, 28 Jul 2026 15:08:31 -0300
Subject: [PATCH] Override adm-zip to 0.6.0 to clear GHSA-xcpc-8h2w-3j85

`onnxruntime-node`, added in #2235, depends on `adm-zip: ^0.5.16`, and the
fix for GHSA-xcpc-8h2w-3j85 landed in 0.6.0. That range cannot reach it, so
npm keeps resolving a vulnerable version and Dependabot keeps flagging it.

An override pulls 0.6.0 in anyway. `onnxruntime-node` only uses
`new AdmZip(path)` and `getEntry`, which are unchanged in 0.6.0, and its
Node requirement moves from >=12 to >=14, which this project already
exceeds.

npm audit goes from 2 high advisories to none.
---
 package-lock.json | 8 ++++----
 package.json      | 3 +++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0197ccde..a12f52d3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2826,12 +2826,12 @@
       "license": "Apache-2.0"
     },
     "node_modules/adm-zip": {
-      "version": "0.5.18",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.18.tgz",
-      "integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
       "license": "MIT",
       "engines": {
-        "node": ">=12.0"
+        "node": ">=14.0"
       }
     },
     "node_modules/ai": {
diff --git a/package.json b/package.json
index 4c9c3103..746a4476 100644
--- a/package.json
+++ b/package.json
@@ -96,5 +96,8 @@
     "vite": "^8.0.0",
     "vitest": "^4.0.0",
     "zod": "^4.3.6"
+  },
+  "overrides": {
+    "adm-zip": "^0.6.0"
   }
 }