fix(deps): patch high production advisories (#6788)

apps/nextjs/src/app/api/backup/export/route.ts

@@ -52,7 +52,7 @@ export async function GET() {
     const date = new Date().toISOString().split("T")[0];
     const filename = `homarr-backup-${date}.zip`;
 
-    return new NextResponse(zipBuffer, {
+    return new NextResponse(new Uint8Array(zipBuffer), {
       status: 200,
       headers: {
         "Content-Type": "application/zip",

pnpm-workspace.yaml

@@ -120,7 +120,7 @@ catalog:
   "@xterm/addon-canvas": ^0.7.0
   "@xterm/addon-fit": 0.11.0
   "@xterm/xterm": ^6.0.0
-  adm-zip: 0.5.18
+  adm-zip: 0.6.0
   acorn: ^8.16.0
   acorn-jsx: ^5.3.2
   jszip: ^3.10.1
@@ -151,7 +151,7 @@ catalog:
   drizzle-zod: ^0.8.3
   embla-carousel-react: ^8.6.0
   esbuild: ^0.28.0
-  fast-xml-parser: ^5.9.3
+  fast-xml-parser: ^5.10.1
   fastify: ^5.9.0
   flag-icons: ^7.5.0
   glob: ^13.0.6
@@ -208,7 +208,7 @@ catalog:
   turbo: ^2.10.4
   typescript: 7.0.2
   vite: ^8.1.4
-  undici: 7.28.0
+  undici: 7.29.1
   use-deep-compare-effect: ^1.8.1
   video.js: ^8.23.9
   vite-tsconfig-paths: ^6.1.1
@@ -248,26 +248,48 @@ overrides:
   "@assistant-ui/core": 0.3.7
   "@assistant-ui/store": 0.3.5
   "@assistant-ui/tap": 0.9.10
+  "@grpc/grpc-js@<1.12.7": "1.12.7"
+  "@rvf/set-get@<7.0.2": "7.0.2"
+  "@xmldom/xmldom@<0.8.15": "0.8.15"
   "assistant-cloud": 0.1.38
   "@babel/helpers@<7.26.10": ">=7.29.7"
   "@babel/runtime@<7.26.10": ">=7.29.7"
-  "axios@>=1.0.0 <1.8.2": ">=1.18.1"
-  "brace-expansion@>=2.0.0 <=2.0.1": ">=5.0.7"
-  "brace-expansion@>=1.0.0 <=1.1.11": ">=5.0.7"
+  "axios@>=1.0.0 <1.18.1": "1.18.1"
+  "brace-expansion@>=1.0.0 <1.1.18": "1.1.18"
+  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
+  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"
+  "browserslist@<4.28.7": "4.28.7"
   "esbuild@<=0.24.2": ">=0.28.1"
+  "fast-uri@>=3.0.0 <3.1.6": "3.1.6"
+  "@ai-sdk/provider-utils>undici": "8.10.2"
+  "find-my-way@<9.6.1": "9.9.0"
   "form-data@>=4.0.0 <4.0.4": ">=4.0.6"
   "hono@<4.6.5": ">=4.12.28"
+  "immutable@>=5.0.0-beta.1 <5.1.8": "5.1.8"
+  "ip-address@<10.3.1": "10.3.1"
+  "js-yaml@>=3.0.0 <3.15.1": "3.15.1"
+  "js-yaml@>=4.0.0 <4.3.1": "4.3.1"
+  "jsdom>undici": "8.10.2"
   "linkifyjs@<4.3.2": ">=4.3.3"
+  "lodash-es@<4.17.24": "4.18.1"
+  "nanoid@>=3.0.0 <3.3.18": "3.3.18"
   "nanoid@>=4.0.0 <5.0.9": ">=5.1.16"
+  "picomatch@>=2.0.0 <2.3.2": "2.3.2"
+  "postcss@<8.5.18": "8.5.18"
   "prismjs@<1.30.0": ">=1.30.0"
   "protobufjs@<7.5.5": ">=7.5.5 <8"
-  "proxmox-api>undici": "7.28.0"
+  "proxmox-api>undici": "7.29.1"
   "react-is": "^19.2.7"
   "rollup@>=4.0.0 <4.22.4": ">=4.62.2"
+  "serialize-javascript@<7.0.5": "7.0.5"
   "sha.js@<=2.4.11": ">=2.4.12"
+  "shell-quote@<1.8.5": "1.10.0"
+  "svgo@>=3.0.0 <3.3.4": "3.3.4"
   "tar-fs@>=3.0.0 <3.0.9": ">=3.1.3"
   "tar-fs@>=2.0.0 <2.1.3": ">=3.1.3"
   "tmp@<=0.2.3": ">=0.2.7"
+  "undici@>=7.0.0 <7.29.1": "7.29.1"
+  "undici@>=8.0.0 <8.9.0": "8.9.0"
   "vite@>=5.0.0 <=5.4.18": ">=8.1.4"
 patchedDependencies:
   "@types/node-unifi": "patches/@types__node-unifi.patch"