From 7db47defbc4bc70209b7bb5db1feda61ae46e450 Mon Sep 17 00:00:00 2001
From: Mattsson <111893710+mattssonn@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:14:23 +0200
Subject: [PATCH] fix(deps): override html-to-text to 10.0.1 to clear
 CVE-2026-40345 (#1832)

Trivy's daily sca scan fails on deepmerge-ts 7.1.5 (HIGH, fixed in 8.0.0),
pulled in via mailparser's exact pin on html-to-text 10.0.0. Upstream
html-to-text 10.0.1 is a patch release that bumps deepmerge-ts to ^8.0.1;
the override lifts it to 8.0.2. Only consumer is mailparser's simpleParser
in the invoice-inbox extension.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 package-lock.json | 26 ++++++++++++++++++--------
 package.json      |  1 +
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f5285a6b..e25cfa7b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9723,12 +9723,22 @@
       "license": "MIT"
     },
     "node_modules/deepmerge-ts": {
-      "version": "7.1.5",
-      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
-      "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-8.0.2.tgz",
+      "integrity": "sha512-uqbvqLUMrc6p0MO+WBRtTxY55hmyh94WRwI5a++PZe54X+bfVh59FSN7uWCBCW1CCVjzjnrwzfI8zidE2obMMw==",
+      "funding": [
+        {
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/rebeccastevens"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/deepmerge-ts"
+        }
+      ],
       "license": "BSD-3-Clause",
       "engines": {
-        "node": ">=16.0.0"
+        "node": ">=16.9.0"
       }
     },
     "node_modules/define-data-property": {
@@ -11334,13 +11344,13 @@
       "license": "ISC"
     },
     "node_modules/html-to-text": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-10.0.0.tgz",
-      "integrity": "sha512-2OH59Gtprdczel+7Rxgpz9hGVJREaf8Lt1H4kZwWHpEn70VQKRuMNGsb2eDbwaTzrYzb0hheiOG1P7Dim0B4dQ==",
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-10.0.1.tgz",
+      "integrity": "sha512-GiVhRI1BatGARSCmlXWNCjDT0cWrwBWoeduLoV0WSKAgaV/wa+hUWy5LiQLUs4UwiUrE52ZCMfBGiKD87TDPrg==",
       "license": "MIT",
       "dependencies": {
         "@selderee/plugin-htmlparser2": "~0.12.0",
-        "deepmerge-ts": "^7.1.5",
+        "deepmerge-ts": "^8.0.1",
         "dom-serializer": "^2.0.0",
         "htmlparser2": "^10.1.0",
         "selderee": "~0.12.0"
diff --git a/package.json b/package.json
index 5afddc6f..19bc9055 100644
--- a/package.json
+++ b/package.json
@@ -105,6 +105,7 @@
     "vitest": "^4.1.9"
   },
   "overrides": {
+    "html-to-text": "10.0.1",
     "ws": "^8.21.0",
     "sharp": "^0.35.3",
     "postcss": "^8.5.18"