fix(deps): drop unused protobufjs-cli from client/web - #44
Merged
Merged
Conversation
src/net/proto.ts parses the .proto schema with the protobufjs runtime specifically to avoid a pbjs codegen step, and nothing in the repo, npm scripts, or CI invokes pbjs/pbts. The dependency only carried a vulnerable subtree: glob@8 -> minimatch@5 -> brace-expansion@2.1.2, which GHSA-mh99-v99m-4gvg flags via its <= 5.0.7 range. Removing it leaves brace-expansion@5.0.8 as the only resolution and takes npm audit from 4 high findings to 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishes closing Dependabot alert #73 (GHSA-mh99-v99m-4gvg, high). PR #43 bumped the 5.x instance to 5.0.8, but the alert stayed open — the advisory's range is
<= 5.0.7, which matchesbrace-expansion@2.1.2too. Dependabot's original conflict error was right that both trees had to move.Why removal instead of an override
client/web/src/net/proto.tsparses the schema with the protobufjs runtime precisely to avoid codegen (see its header comment: "keeps the build chain free of a separate pbjs codegen step"). Nothing in the repo, npm scripts, or CI invokespbjs/pbts— the only references toprotobufjs-cliwere its ownpackage.jsonentry and that comment. It existed solely to carryglob@8 -> minimatch@5 -> brace-expansion@2.1.2. Noteprotobufjs-cli@2.6.1(latest) still depends onglob@^8, so upgrading would not have helped.The alternative was
overrides: { "brace-expansion": "^5.0.8" }, which works (v5's CJS export is still a bare function, sominimatch@5would not break) but keeps an unused toolchain plusjsdoc/espree/escodegen/tmpin the tree.Result
brace-expansion@5.0.8resolves; nominimatch@5/glob@8leftnpm audit: 4 high -> 0 vulnerabilitiesVerification
npm cicleannpm test14/14 passednpm run build-nologsucceededIf you do use
pbjsmanually outside the repo, say so and I'll switch to the override approach instead.