chore(deps): resolve Dependabot critical/high/moderate alerts#119
Merged
Conversation
Direct bumps: - vitest + @vitest/coverage-v8 ^3.2.4 → ^4.1.0 in root (patches GHSA-5xrq-8626-4rwp, critical, arbitrary file read/exec via Vitest UI server). Resolves to 4.1.8. - react-router-dom ^7.14.0 → ^7.15.0 in apps/role-manager. Patches three react-router CVEs in one bump: - GHSA-49rj-9fvp-4h2h (high, RCE via turbo-stream TYPE_ERROR deserialization) — patched 7.14.2 - GHSA-2j2x-hqr9-3h42 (medium, open redirect via // protocol-relative URL) — patched 7.14.1 - GHSA-8x6r-g9mw-2r78 (high, DoS via unbounded path expansion in __manifest endpoint) — patched 7.15.0 react-router resolves to 7.17.0. Override migration: package.json#pnpm → pnpm-workspace.yaml. pnpm v11 silently ignores package.json#pnpm.overrides; minimumReleaseAge and minimumReleaseAgeExclude also need to live in the workspace yaml to take effect. vitest / @vitest/* added to the exclude list since some of their dist metadata is missing the `time` field. New security overrides: - axios <1.16.0 → ^1.16.0 (15 advisories: prototype pollution, SSRF, header/CRLF injection, ReDoS, etc.) - hono <4.12.21 → ^4.12.21 (~10 advisories: cookie injection, JWT issues, cache leakage, IP restriction bypass, etc.) - protobufjs <7.5.8 → ^7.5.8 (8 advisories: RCE, DoS, prototype pollution) - @protobufjs/utf8 <1.1.1 → ^1.1.1 (overlong UTF-8 decoding) - tmp <0.2.6 → ^0.2.6 (path traversal via symlink) - lodash <4.18.0 → ^4.18.0 (code injection, prototype pollution) - fast-uri <=3.1.1 → ^3.1.2 (host confusion, path traversal) - @metamask/sdk + @metamask/sdk-communication-layer <0.33.1 → ^0.33.1 (malicious debug@4.4.2 transitive) - ip-address <=10.1.0 → ^10.1.1 (XSS in Address6 HTML) - ws >=8.0.0 <8.20.1 → ^8.20.1 (uninitialized memory disclosure) Not fixed in this PR (justifications for dismissal in Security tab): - uuid <11.1.1 (GHSA-w5hq) — CVE only affects v3/v5/v6(buf); our chain uses v4(). Forcing ^11 elsewhere breaks @solana/web3.js peer constraints, and v11.1.1 is already present alongside the older versions in this lockfile. - elliptic 6.6.1 (GHSA-848j) — no upstream patch exists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single-PR sweep of open Dependabot advisories on role-manager. Knocks out 3 criticals, 16 highs, and most moderates by bumping direct deps and migrating + adding workspace pnpm overrides.
Direct dep bumps
vitest+@vitest/coverage-v8^3.2.4→^4.1.0(root) — patches GHSA-5xrq-8626-4rwp (arbitrary file read/exec via Vitest UI server). Resolves to4.1.8.react-router-dom^7.14.0→^7.15.0(apps/role-manager) — covers three react-router CVEs in one bump://protocol-relative URL)__manifest)Resolves to
react-router@7.17.0.Override migration:
package.json#pnpm→pnpm-workspace.yamlpnpm v11 silently ignores
package.json#pnpm.overrides. `minimumReleaseAge` + `minimumReleaseAgeExclude` also need to live in the workspace yaml to take effect. `vitest` / `@vitest/*` added to the exclude list since some of their dist metadata is missing the `time` field.New security overrides
Not fixed in this PR (justifications for dismissal in Security tab)
Test plan