Repository navigation
Move fast-uri to 3.1.7, clearing the audit gate - #140
Merged
Merged
Conversation
`npm audit --audit-level=high` is a CI step and has been red on every branch, with no repository change behind it. Four high advisories against fast-uri 3.0.0-3.1.5, reached through the direct devDependency `ajv`: GHSA-5jgf-p345-68v8 host confusion via skipped IDN canonicalization GHSA-f65p-4m7j-42xc SSRF via malformed IPv6 normalization GHSA-fph4-wmhf-6fwf SSRF via repeated hostname percent-decoding GHSA-jqff-g426-hqxp host confusion via percent-encoded scheme normalization This is a lockfile move inside an already-satisfied range, not a dependency bump: ajv@8.20.0 declares `"fast-uri": "^3.0.1"` and 3.1.7 is published, above the vulnerable range and inside that caret. `package.json` is untouched and `ajv@latest` is still 8.20.0, so there is no ajv release to move to. `npm audit fix` did not take it; `npm update fast-uri` does. ajv validates every schema, fixture and example here, so the resolution change was not assumed free: the whole CI gate list was re-run under it. All 32 gates pass, and `npm audit --audit-level=high` now reports 0 vulnerabilities. Practical exposure was low either way — fast-uri is reached only through ajv's `format: "uri"` handling of this repository's own committed schemas, and the advisories concern a consumer that resolves the parsed URI, which nothing here does. The reason to fix it is that a permanently red CI step trains everyone to ignore CI. Closes #135.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #135.
npm audit --audit-level=highis a CI step and has been red on every branch with no repository change behind it — the third time it has gone red on a newfast-uriadvisory.It is a lockfile move, not a dependency bump
ajv@8.20.0declares"fast-uri": "^3.0.1", and 3.1.7 is published — above the vulnerable3.0.0 - 3.1.5range and inside that caret. The lockfile simply pinned 3.1.5.package.jsonis untouched, andajv@latestis still 8.20.0, so there is no ajv release to move to.npm audit fixdid not take it.npm update fast-uridoes. The entire diff:plus its
resolvedandintegritylines. Three lines.Verified, not assumed
ajvvalidates every schema, fixture and example in this repository, so a resolution change is not free. The full CI gate list was re-run under the new resolution:tsc,npm test,test:canonicalize,test:document-verdict,test:container-reader, everycheck:*, andgenerate:template --preset all.npm audit --audit-level=highnow reports 0 vulnerabilities.On severity
Practical exposure here was low in either direction, and the issue says so rather than overselling it:
fast-uriis reached only throughajv'sformat: "uri"handling of this repository's own committed schemas. There is no runtime — the package shipsspec/,schemas/andconformance/— and the advisories concern a consumer that resolves the parsed URI, which nothing here does.The reason to fix it is that a permanently red CI step trains everyone to ignore CI. It was about to mask the audit result on #139 and on everything after it.