From 6ffaf9669d906a6d9cbb9d56c9615af1415092f2 Mon Sep 17 00:00:00 2001 From: Joshua Schuller <116460872+jschuller@users.noreply.github.com> Date: Sun, 11 Oct 2026 18:40:29 -0400 Subject: [PATCH] docs: explain SDK development-dependency advisories in SECURITY.md Dependabot reports advisories (2 critical, 8 high) in transitive dependencies of @servicenow/sdk 4.13.6 (handlebars, fastify, js-yaml, joi, undici). None of them is in the packaged app. Document that they are fixed by SDK updates through the grouped Dependabot PR, and that npm overrides are a fallback only after the next SDK release. Claude-Session: https://claude.ai/code/session_01MYbPFQzCE5G9HGmQa7nNAf --- CHANGELOG.md | 4 ++++ SECURITY.md | 23 ++++++++++++++++++++--- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f53d953..7dd72dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ version needs manual work to adopt it. delete (secured record steps and `AppService` 403s, `can_write`/`can_delete` false), and a user with only `x_snc_example.admin` may update (200) and delete (204, then 404), with `can_write`/`can_delete` true. +### Changed +- `SECURITY.md` explains the advisories reported in the SDK's development dependencies: they do not reach the + installed app, are fixed by SDK updates, and are not overridden by default. + ## [1.0.0] - 2026-10-10 > Brazil-ready, agent-neutral, verified on an instance. diff --git a/SECURITY.md b/SECURITY.md index 6b0f958..da633dd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -32,6 +32,23 @@ Do not open a public issue. ## Known advisories in development tooling -`npm audit` reports advisories in packages that `@servicenow/sdk` depends on (for example `undici` inside the SDK CLI). -They affect the developer's machine and CI while running the SDK, not the app installed on the instance, and are fixed by -SDK updates. Dependabot proposes those updates as they ship. +`npm audit` and the repository's Dependabot alerts list advisories, some rated high or critical, in packages that +`@servicenow/sdk` depends on: for example `handlebars`, `fastify`, `js-yaml`, `joi` and `undici`. They are all +*development* dependencies of the SDK's own tooling (UI bundling and its development server, templating, SBOM +generation, HTTP calls to the instance). They run on the developer's machine and in CI while the SDK runs. None of them +is part of the app installed on the instance: the package `now-sdk pack` builds contains only the app's metadata, its +server scripts and the UI bundle (React and the code in `src/client`). + +How the template handles them: + +- **Fixed by SDK updates.** The SDK is pinned to an exact version, so its dependencies move only when ServiceNow + publishes a new SDK. Dependabot opens one grouped pull request for the `@servicenow/*` packages when it does; such a + pull request is merged after the build and a test-instance deployment pass, like any SDK upgrade + ([docs/compatibility.md](docs/compatibility.md)). +- **No `overrides` by default.** Forcing versions the SDK was not released with can break builds and installs in ways + that are hard to trace. If a critical advisory is still open after the next SDK release, patched versions may be + pinned through npm `overrides` in a release that is verified on an instance first. +- **Reducing exposure meanwhile:** run the SDK only on projects and instances you trust. + +An advisory in a package that does reach the instance (React, or code in `src/`) is a vulnerability in this template: +report it as described above.