fix(deps): pin protobufjs 7 + ws 8.21 via overrides (clears critical + 7 highs) - #112
Closed
catomean wants to merge 1 commit into
Closed
fix(deps): pin protobufjs 7 + ws 8.21 via overrides (clears critical + 7 highs)#112catomean wants to merge 1 commit into
catomean wants to merge 1 commit into
Conversation
…+ 7 highs) Transitive-only override bumps — no runtime code change: - protobufjs 6.11.4 → 7.6.5: clears the CRITICAL (protobufjs < 7.5.5) plus 6 HIGH + several MEDIUM alerts. Also pulls @protobufjs/utf8 1.1.0 → 1.1.2 (clears its MEDIUM). protobufjs is pulled only via @xenova/transformers → onnxruntime-web → onnx-proto, which is the BROWSER ONNX backend; botsmann runs embeddings server-side (lib/embeddings.ts) through onnxruntime-node (native), so this proto/JS path is never executed — the 6→7 major is zero-risk here. Verified: transformers still imports cleanly and `next build` is green. - ws 8.19.0 → 8.21.1: clears the HIGH (DoS) + MEDIUM. Pulled via @supabase/realtime-js and jsdom, both on ^8 — patch-compatible. Avoids the breaking @xenova/transformers v2→v3 migration (package rename to @huggingface/transformers) that would otherwise be needed just to move protobufjs off 6.x. Chosen because the vulnerable path is not executed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 23, 2026
Closed
Collaborator
Author
|
Superseded by the consolidated security-overrides PR rebased onto Next 16 main (landed as the merge including sharp ^0.35.3 + the full override set). protobufjs/ws are included. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two transitive-only
overridesbumps — no application code changes:protobufjs6.11.4→7.6.5@protobufjs/utf8(transitive of ↑)1.1.0→1.1.2ws8.19.0→8.21.1Why an override, not the transformers v3 migration
The vulnerable
protobufjsis v6, and there is no patched 6.x — the critical requires≥ 7.5.5. It's pulled purely transitively:onnxruntime-webis the browser ONNX backend. Botsmann runs embeddings server-side (lib/embeddings.ts,Xenova/all-MiniLM-L6-v2) viaonnxruntime-node(native bindings) — soonnx-proto/protobufjsis never executed at runtime. Forcing protobufjs 6→7 therefore carries no runtime risk here, and avoids the breaking@xenova/transformersv2→v3 migration (package rename to@huggingface/transformers) that would otherwise be the only other way off protobufjs 6.wsis pulled via@supabase/realtime-jsandjsdom, both on^8— 8.21.1 is patch-compatible.Verification
npm ls— single copies:protobufjs@7.6.5,@protobufjs/utf8@1.1.2,ws@8.21.1npm audit— protobufjs and ws no longer flagged@xenova/transformersstill imports cleanly server-side (module graph resolves with protobufjs 7)next buildgreenScope note
Combined with #111 (Next 15) this closes the
next+protobufjs+wsDependabot highs. The remaining open transitive highs on this repo —picomatch,handlebars,fast-xml-parser,flatted,minimatch(all dev/build-tooling) — are the same override technique but each needs per-package version care (e.g. picomatch's 2.x-vs-4.x split); they belong in a separate focused PR, not this one.🤖 Generated with Claude Code