fix(deps): resolve all npm audit advisories to zero - #1459
Open
zapolsky wants to merge 5 commits into
Open
Conversation
TypeORM <0.3.31 is vulnerable to template-literal code injection in migration:generate. Bump the direct dependency in apps/backend and packages/test-utils to ^0.3.31. Peer range of @nestjs/typeorm (^0.3.0) is satisfied; prod build (tsconfig.build.json) type-checks clean.
adm-zip <0.6.0 allows a crafted ZIP to trigger a 4GB memory allocation. Bump the direct dependency in @owox/connectors. The only consumed API (new AdmZip(buffer), getEntries, getData) is unchanged; build, unit tests (16) and a round-trip smoke test pass.
, GHSA-f48w-9m4c-m7f5, GHSA-7pw4-f3q4-r2p2) astro <=7.0.9 has three reflected/stored XSS advisories (View Transition props, spread attribute names, transition:* directives). Bump apps/docs: - astro ^6.4.2 -> ^7.1.3 (node >=22.12 satisfied by repo engines) - @astrojs/starlight ^0.39.2 -> ^0.41.4 (pulls patched @astrojs/mdx ^7, astro-expressive-code ^0.44) - sharp ^0.34.0 -> ^0.35.0 (astro 7 accepts ^0.34 || ^0.35) - starlight-links-validator ^0.24.1 -> ^0.25.2 (starlight 0.41 / astro 7) astro.config sidebar already uses the label+items autogenerate shape, so no config migration was needed. Full wipe reinstall collapsed the duplicate astro/starlight trees to single versions. docs build passes: 145 pages, image optimization and link validation green. The clean reinstall also floated two in-range transitive advisories to patched: fast-uri 3.1.3 -> 3.1.4 (GHSA-v2hh-gcrm-f6hx, via ajv) and fast-xml-parser 5.10.0 -> 5.10.1 (GHSA-8r6m-32jq-jx6q, via snowflake-sdk).
…HSA-f88m-g3jw-g9cj, GHSA-frvp-7c67-39w9) Two production advisories fixable only by out-of-range overrides: - sharp <0.35.0 inherits libvips CVEs (CVE-2026-33327/33328/35590/ 35591). @huggingface/transformers pins sharp ^0.34.1, so no in-range version is patched. Top-level override to ^0.35.0 forces 0.35.3 (libvips 8.18.3). This also clears the transitive @huggingface/transformers high advisory. Verified: sharp encodes, transformers loads and exposes pipeline/tokenizer with 0.35. - @hono/node-server <2.0.5 has a Windows serve-static path traversal. @modelcontextprotocol/sdk pins ^1.19.9 and there is no patched 1.x, so a scoped override forces ^2.0.5 (2.0.11). MCP only uses getRequestListener (not serve-static), which is unchanged in 2.x and still ships CJS. This also clears the transitive MCP sdk advisory. Verified end-to-end: getRequestListener converts a Node request and returns 200; StreamableHTTPServerTransport loads. Applied via full node_modules + lockfile wipe (out-of-range overrides require it). Backend build green; 844 mcp/search unit tests pass. npm audit and npm audit --omit=dev now report 0 vulnerabilities.
astro 7's prerenderer imports { parseCookie, stringifySetCookie } from
'cookie', which only exist in cookie@2.x (ESM). express@5 and
cookie-parser (via the idp packages) pull cookie@0.7.2 (CommonJS,
parse/serialize), which npm hoists to the root. Depending on hoisting,
astro build resolved the root 0.7.2 and failed with 'Named export
parseCookie not found ... is a CommonJS module', breaking the CI
'Build' job even though the local build had passed against an earlier
node_modules layout.
Declare cookie ^2.0.1 as a docs devDependency so a 2.x copy is always
nested under apps/docs for the build, while the root stays 0.7.2 for
express/cookie-parser (verified their parse/serialize API still loads).
docs build green: 145 pages. npm audit still 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drives
npm auditandnpm audit --omit=devfrom 12 advisories (6 high, 6 moderate) to 0, across four atomic, individually-validated commits.typeorm0.3.30 → 0.3.31 (backend + test-utils)adm-zip0.5.16 → 0.6.0 (@owox/connectors)sharp^0.35.0, MCP's@hono/node-server^2.0.5The clean reinstall also floated two in-range transitive advisories to patched: fast-uri 3.1.4 (GHSA-v2hh-gcrm-f6hx) and fast-xml-parser 5.10.1 (GHSA-8r6m-32jq-jx6q).
Notes on the out-of-range overrides
@huggingface/transformerspins^0.34.1, so no in-range version carries the libvips CVE fix; the override forces 0.35.3. Verified sharp encodes and transformers loads with it.@modelcontextprotocol/sdkpins^1.19.9with no patched 1.x. MCP uses onlygetRequestListener(not the vulnerableserve-static), which is unchanged in 2.x; verified end-to-end (request -> 200) and that the transport loads.Validation
npm auditandnpm audit --omit=dev: 0 vulnerabilities