취약 의존성을 갱신하고 PM2 파일 감시를 비활성화한다

app/game-api/package.json

@@ -40,10 +40,10 @@
         "@trpc/server": "^11.8.1",
         "date-fns": "^4.1.0",
         "es-toolkit": "^1.43.0",
-        "fastify": "^5.6.2",
+        "fastify": "^5.12.5",
         "redis": "^5.10.0",
-        "sanitize-html": "2.17.6",
-        "sharp": "^0.35.0",
+        "sanitize-html": "2.17.7",
+        "sharp": "^0.35.5",
         "zod": "^4.3.5"
     }
 }

app/game-frontend/package.json

@@ -35,14 +35,14 @@
     "dependencies": {
         "@sammo-ts/common": "workspace:*",
         "@sammo-ts/logic": "workspace:*",
-        "@tiptap/extension-image": "^3.5.0",
-        "@tiptap/extension-link": "^3.5.0",
-        "@tiptap/extension-placeholder": "^3.5.0",
-        "@tiptap/extension-text-align": "^3.5.0",
-        "@tiptap/extension-text-style": "^3.5.0",
-        "@tiptap/extension-underline": "^3.5.0",
-        "@tiptap/starter-kit": "^3.5.0",
-        "@tiptap/vue-3": "^3.5.0",
+        "@tiptap/extension-image": "^3.30.5",
+        "@tiptap/extension-link": "^3.30.5",
+        "@tiptap/extension-placeholder": "^3.30.5",
+        "@tiptap/extension-text-align": "^3.30.5",
+        "@tiptap/extension-text-style": "^3.30.5",
+        "@tiptap/extension-underline": "^3.30.5",
+        "@tiptap/starter-kit": "^3.30.5",
+        "@tiptap/vue-3": "^3.30.5",
         "@trpc/client": "^11.8.1",
         "@trpc/server": "^11.8.1",
         "@vueuse/core": "^14.1.0",
@@ -52,7 +52,7 @@
         "mitt": "^3.0.1",
         "pinia": "^3.0.4",
         "tippy.js": "6.3.7",
-        "vue": "^3.5.26",
+        "vue": "^3.5.42",
         "vue-draggable-plus": "0.6.1",
         "vue-router": "^4.6.4",
         "zod": "^4.3.5"

app/gateway-api/package.json

@@ -40,12 +40,12 @@
         "@trpc/server": "^11.8.1",
         "date-fns": "^4.1.0",
         "es-toolkit": "^1.43.0",
-        "fastify": "^5.6.2",
+        "fastify": "^5.12.5",
         "ipaddr.js": "2.5.0",
         "pm2": "^7.0.3",
         "redis": "^5.10.0",
-        "sanitize-html": "2.17.6",
-        "sharp": "^0.35.0",
+        "sanitize-html": "2.17.7",
+        "sharp": "^0.35.5",
         "web-push": "3.6.7",
         "zod": "^4.3.5"
     }

app/gateway-api/src/orchestrator/pm2ProcessManager.ts

@@ -54,6 +54,8 @@ export const buildPm2StartOptions = (definition: ProcessDefinition) => ({
     args: definition.args,
     env: sanitizePm2IdentityEnv(definition.env ?? {}),
     autorestart: true,
+    // PM2의 chokidar/braces glob parser에 사용자 입력을 전달하는 watch 경로는 사용하지 않는다.
+    watch: false,
     max_restarts: 5,
     min_uptime: 10_000,
     restart_delay: 2_000,

app/gateway-api/test/pm2ProcessManager.test.ts

@@ -26,6 +26,7 @@ describe('buildPm2StartOptions', () => {
         expect(options).toMatchObject({
             name: 'sammo:che:2:game-api',
             autorestart: true,
+            watch: false,
             max_restarts: 5,
             min_uptime: 10_000,
             restart_delay: 2_000,

app/gateway-frontend/package.json

@@ -26,7 +26,7 @@
         "es-toolkit": "^1.43.0",
         "mitt": "^3.0.1",
         "pinia": "^3.0.4",
-        "vue": "^3.5.26",
+        "vue": "^3.5.42",
         "vue-router": "^4.6.4",
         "zod": "^4.3.5"
     },