From d9d4423496166644df7454a75e9dcacc06a545a8 Mon Sep 17 00:00:00 2001
From: zhangxiang <zhangxiang@novalon.cn>
Date: Wed, 19 Aug 2026 14:43:47 +0800
Subject: [PATCH] fix(deps): patch deepmerge-ts to 8.0.1 and document
 extract-zip residual
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

修复 GHSA-ggr8-5vv4-36mx（deepmerge-ts 栈爆破）via overrides.deepmerge-ts=^8.0.1，
已验证 prisma validate/generate 与全量单测通过、依赖树无 invalid。剩余 extract-zip
high（GHSA-jmr9-qjv8-65gv）为 @lhci/cli dev 工具链且无非破坏性补丁，记录为已知
dev 残留；生产依赖 npm audit --omit=dev 为 0 漏洞。
---
 package-lock.json | 32 +++++++++++++-------------------
 package.json      |  5 ++++-
 2 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e052a31..b7d9940 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12805,9 +12805,19 @@
       }
     },
     "node_modules/deepmerge-ts": {
-      "version": "7.1.5",
-      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
-      "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-8.0.1.tgz",
+      "integrity": "sha512-szCXE7YLCvLKR9bFPJcvsezOShdalctSvrgN/LM/QGUEPZQajwjmsMObZ6/DuANT5lxzM/wtO8Feubwdkz8myA==",
+      "funding": [
+        {
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/rebeccastevens"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/deepmerge-ts"
+        }
+      ],
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=16.0.0"
@@ -22679,22 +22689,6 @@
         "node": ">= 16.0.0"
       }
     },
-    "node_modules/typed-rest-client/node_modules/qs": {
-      "version": "6.15.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
-      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "side-channel": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/typedarray-to-buffer": {
       "version": "3.1.5",
       "resolved": "https://registry.npmmirror.com/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
diff --git a/package.json b/package.json
index 4840864..48675ba 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "test:e2e:fast": "cd e2e && npx playwright test --grep '@smoke|@critical'",
     "test:e2e:standard": "cd e2e && npx playwright test --grep @regression",
     "test:e2e:journey": "cd e2e && npx playwright test --grep @journey",
+    "test:e2e:journey:home": "cd e2e && npx playwright test uj-11-home-conversion.spec.ts --project=chromium --project=chromium-mobile",
     "test:e2e:mobile": "cd e2e && npx playwright test --grep @mobile",
     "test:e2e:mobile:performance": "cd e2e && npx playwright test --grep @mobile.*@performance",
     "test:e2e:mobile:accessibility": "cd e2e && npx playwright test --grep @mobile.*@accessibility",
@@ -160,6 +161,8 @@
     "ws": "^8.21.1",
     "esbuild": "^0.28.1",
     "glob": "^13.0.6",
-    "sharp": "^0.35.3"
+    "sharp": "^0.35.3",
+    "qs": "^6.15.2",
+    "deepmerge-ts": "^8.0.1"
   }
 }