override and update deps with security issues

[james-elicx]

This PR bumps / overrides certain deps to address the following security issues flagged in a Snyk scan.

  ✗ Allocation of Resources Without Limits or Throttling [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-BODYPARSER-14105059] in [email protected]
    introduced by [email protected] > [email protected]
  This issue was fixed in versions: 2.2.1
  ✗ Regular Expression Denial of Service (ReDoS) [Low Severity][https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073] in [email protected]
    introduced by @node-minify/[email protected] > [email protected] > [email protected] > [email protected]
  This issue was fixed in versions: 1.1.12, 2.0.2, 3.0.1, 4.0.1
  ✗ Improper Input Validation [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-NANOID-8492085] in [email protected]
    introduced by [email protected] > [email protected] > [email protected]
  This issue was fixed in versions: 3.3.8, 5.0.9
  ✗ Allocation of Resources Without Limits or Throttling [High Severity][https://security.snyk.io/vuln/SNYK-JS-QS-14724253] in [email protected]
    introduced by [email protected] > [email protected] and 1 other path(s)
  This issue was fixed in versions: 6.14.1

It also bumps the pnpm version used in the pipelines so that catalog overrides are respected.

[changeset-bot]

🦋 Changeset detected

Latest commit: 72beed9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@opennextjs/aws	Patch
app-pages-router	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@opennextjs/aws@1075

commit: 72beed9

[vicb]

Not a big fan of overrides...
Can we figure out if we depend on them at runtime?

[james-elicx]

qs and body-parser are for express which is used by the express-dev wrapper and unlikely to ever be used by a consumer. brace-expansion is a deeply nested dependency of @node-minify/core which is used to minify JS in the server bundle.

These overrides are 1 patch version above the version that is currently depended on because those patches were released solely to resolve the security issue in their respective libraries.

[dacevedo12]

BTW, is this exact pinning really necessary? GHSA-6475-r3vj-m8vf

[conico974]

Aws has proven to be not very good at respecting semver, they had some big breaking changes at times (that broke thing for a few versions and was fixed after)
I think we should keep pinning, but just update the SDK and ensure that everything works, maybe in another PR