chore(security): patch form-data, ignore dev-only vite advisory#68
Merged
Conversation
Two high-severity advisories surfaced in the repo-wide `pnpm audit --audit-level=high` gate (both transitive, both newly disclosed, so they now fail CI on main as well): - form-data (GHSA-hmw2-7cc7-3qxx, <4.0.6): CRLF injection via unescaped multipart field names/filenames. Reaches the runtime via @slack/web-api. Fixed with a pnpm override forcing form-data >=4.0.6 (a safe 4.x patch bump; proxy + Slack channel tests pass on 4.0.6). - vite (GHSA-fx2h-pf6j-xcff, <=6.4.2): server.fs.deny bypass in the vite DEV server. The dashboard ships as prebuilt static assets served by the proxy; the vite dev server never runs in production, so the advisory does not affect the shipped artifact. Added to ignoreGhsas as dev-only, matching the esbuild precedent (#63). To be dropped when vite is upgraded (#64).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Two high-severity advisories surfaced in the repo-wide
pnpm audit --audit-level=highgate (both transitive, both newly disclosed, so they now fail CI on main as well):Closes #
Type of Change
Packages Affected
packages/proxypackages/dashboardpackages/python-sdkdocs/examples/Checklist
pnpm audit --audit-level=highnow exits 0, plus lint / format:check / typecheck / test/ build)
How to Test
pnpm audit --audit-level=high→ exits 0 (0 non-ignored high/critical advisories).pnpm why form-data→ resolves to>=4.0.6.pnpm test→ full suite passes (Slack@slack/web-apipath exercised on form-data 4.0.6). (No Closes #… — this is maintenance; it references chore(deps): upgrade vite so esbuild ≥0.28.1, then drop the GHSA-gv7w-rqvm-qjhr audit ignore #64 but doesn't close it.)Additional Context