Repository navigation
fix(deps): patch critical/high CVEs - #37
Merged
Merged
Conversation
Minimal same-major upgrades for vulnerable dependencies reported by pnpm audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014XqKqjvyaMENCpGUFQqRHd
Owner
Author
|
Automated review — not merged. Diff reviewed (scoped same-major overrides + promptfoo 0.121→0.125 in apps/evals for the simple-git critical). 8 critical + 75 high → 0 critical, 3 high. Local build/lint/typecheck/test pass (Node 24, pnpm 11), same as main. CI failures:
Generated by Claude Code |
Zod 3.25.76, basic-ftp 5.3.1, and @azure/msal-node 5.2.2 were still high after the first remediation and the prod audit gate failed on zod. Move direct zod ranges to ^4.6.6, override the vulnerable transitive copies, and adapt OperationSchema plus the dashboard editor to Zod 4. Co-authored-by: Ruben Glez. <RubenGlez@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches critical and high severity vulnerabilities reported by
pnpm audit, using the smallest upgrade within the same major version (no breaking major bumps).package.json.overrides(only the vulnerable range is redirected).nextnextnextproxy-addrnextpromptfoo (apps/evals)nextpromptfoo (apps/evals)@modelcontextprotocol/sdk@xmldom/xmldombody-parserjs-yamlengine.ioundicisocket.io-parseraxios@xmldom/xmldom@modelcontextprotocol/sdkundici@xmldom/xmldomundiciaxiosvitefast-urinode-forgefastifysource-map-jsbrace-expansion@xmldom/xmldom@modelcontextprotocol/sdkbrowserslistfast-uriadm-zipnode-forgeadm-zip@xmldom/xmldompromptfoo (apps/evals)node-forgenode-forgefollow-redirects@xmldom/xmldomelysia@xmldom/xmldomfastifyaxios@xmldom/xmldombrowserslistnextfast-uri@modelcontextprotocol/sdkfast-uripromptfoo (apps/evals)@xmldom/xmldomnode-forgefastifyadm-zipnode-forgefast-uriaxiosaxioszodfollow-redirectsip-addressnextfastifyfollow-redirectsbrace-expansionundicifast-uriaxiosadm-zipundicisharpbrace-expansioncompression@xmldom/xmldomundici@xmldom/xmldomsharpaxiosundiciNot fixed (requires a major upgrade)
basic-ftpzod@azure/msal-nodeVerification
pnpm audit: 8 critical + 75 high → 0 critical, 3 high remaining (all need major upgrades, see above)promptfoo(apps/evals only, not shipped) bumped 0.121 → 0.125 to pullsimple-git4.x — the only fix for 2 critical advisories. Eval runs need API keys and were not executed.build✅lint✅typecheck✅test✅ — same as onmain.pnpm audit --audit-level=high --prodmay still fail because of the remainingzod3 advisory in apps/dashboard.Generated by Claude Code
Summary
Clears critical and high advisories on
mainwithout disabling CI gates.pnpm auditon this head reports 0 critical and 0 high (5 low, 23 moderate left untouched).Two commits:
4818fdc— same-major upgrades and scoped overrides for the criticals and the highs that had a fix inside the current major.329256a— the three highs that remained, all of which need a newer major somewhere in the chain, plus the Zod 4 call-site fixes required for that bump to typecheck.CI on
4818fdc(diagnosed, not re-labeled)pnpm audit --audit-level=high --prod, solely onzod@3.25.76/ GHSA-mrhx-c7xc-m3w5 (high, patched>=4.6.6).deepseek/deepseek-chatmean 0.571 (threshold 0.85). Six fixtures scored 0 withunparseable model output: invalid JSONafter 3 attempts.openai/gpt-4oandanthropic/claude-haiku-4-5-20251001scored 1.000.@ai-sdk/deepseekstayed2.0.35(same resolution asmain); the generator was not edited in4818fdc. Treated as a provider-output failure, not a dependency break. The gate threshold was not changed and the check was not skipped. This follow-up touchespackages/core/**, so the gate runs again.Audit sources
pnpm audit(npm advisory database, pnpm 11.15.1), not GitHub alert counts.main972d2564818fdc329256a(this head)329256a--prod(the CI gate)GitHub alert APIs were queried and are not evidence of “zero vulnerabilities”:
dependabot/alerts→ HTTP 403, bodyDependabot alerts are disabled for this repository.HeaderX-Accepted-Github-Permissions: vulnerability_alerts=read.vulnerabilityAlertsreturnedtotalCount: 0. With alerts disabled, that empty result is not a clean bill of health.main(run 42248480944) did list the same vulnerable packages and failed in the updater. Severities below come from the public GitHub Advisory API and frompnpm audit.Highs fixed in
329256azod^4.6.6, published 2026-10-12)@easydocs/coreand@easydocs/dashboard, and the peer resolved byai/@ai-sdk/*. No 3.x release is patched (<4.6.6). Overridezod@<4.6.6covers any older copy.basic-ftpapps/evals > promptfoo > proxy-agent > pac-proxy-agent > get-uri.get-uristill declares^5.3.1; 6.2.6 keepsClient.access/list/lastMod/downloadTo/close.@azure/msal-nodepromptfoo > @azure/ai-projects > @azure/identity. Identity 4.14.1 (published 2026-10-29) is the 4.x release that depends on@azure/msal-node ^7.1.0.@azure/ai-projects@2.2.0allows^4.13.0. Identity loads;msal-node@7.2.1was skipped byminimumReleaseAge: 1440(published 2026-11-06 23:51Z).Zod 4 call sites, no behavior change intended:
z.record(value)→z.record(z.string(), value)inOperationSchema(Zod 4 requires the key schema).SpecEditorreadsZodError.issues(errorswas removed). Message shape:responses.200.description: Invalid input: expected string, received undefined..strict()on config objects still rejects unknown keys.Already fixed on
4818fdc(still in this branch)Critical:
next(GHSA-2464-fhr4-w9xw, GHSA-2xp9-vwfh-vxw4, GHSA-673q-mjm6-r5xr, GHSA-p293-qw3h-jr36, GHSA-vcvr-r3jv-pc5j) via>=16.4.1(resolved 16.4.5);proxy-addrGHSA-jqcg-44mw-7w3h>=2.0.8;simple-git/@simple-git/argv-parser(GHSA-x6jw-m9v5-85vh, GHSA-v5rq-49vh-5v5c) viapromptfoo0.121.19 → 0.125.1 in privateapps/evalsonly.Highs cleared there include
@modelcontextprotocol/sdk,@xmldom/xmldom,adm-zip,axios,body-parser,brace-expansion,browserslist,compression,elysia,engine.io,fast-uri,fastify,follow-redirects,ip-address,js-yaml,node-forge,sharp,socket.io-parser,source-map-js,undici,vite, and thesimple-githighs. Versions are the scoped overrides inpnpm-workspace.yaml.Verification on this head (Node 24.22.2, pnpm 11.15.1)
pnpm install --frozen-lockfile— passpnpm --filter './packages/*' build— passpnpm lint— pass (including dashboard)pnpm typecheck— pass (dashboard failed once onZodError.errors, then passed after the.issuesfix)pnpm test— pass (core 18 files, express/fastify/elysia/hono/h3/nestjs 1 each, nextjs 2, trpc 3, cli 2)pnpm audit --audit-level=highand--prod— exit 0Clientmethods used byget-uriare present on 6.2.6@azure/identity@4.14.1imports and declares@azure/msal-node ^7.1.0(installed 7.2.0)The accuracy gate was not re-run locally:
DEEPSEEK_API_KEY,OPENAI_API_KEY, andANTHROPIC_API_KEYare unset in this environment. It is still required in CI. Not merged.Moderate and low advisories were not patched on purpose. The moderate count dropped 25 → 23 only because the identity/msal override replaced that subtree.