You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Clears the long-running Dependabot alerts our Vanta report keeps flagging, plus a high-severity runtime one I found while doing it.
Summary
vite.https://github.com/FlowFuse/node-red-dashboard/security/dependabot/189 has no fix on vite 5, so this moves us to vite 6.4.4. The old Dependabot PR (#2147, vite 6.4.3) couldn't clear it because vitepress 1.6.4 wants vite ^5.4.14 and kept its own nested vite 5. I've added a nested override so vitepress uses the root vite. vitepress 2 would fix it properly, but it's still alpha and needs vite 8.
sigstore.https://github.com/FlowFuse/node-red-dashboard/security/dependabot/201 is not one of our deps. It sits inside the npm package, which @node-red/registry 4.1.x depends on (npm ^10.9.9), and npm bundles its own dependencies. An override can't reach a bundled dep. The only lever is npm's own version. npm 10.9.9 is the last 10.x and bundles sigstore 3.1.0, so I've overridden npm to 11.21.0. That's the exact version @node-red/registry 5.0.8 pins, so Node-RED 5 already runs this combination.
engine.io.https://github.com/FlowFuse/node-red-dashboard/security/dependabot/283 is high severity and, unlike the two above, in a runtime dependency. engine.io is the transport under the dashboard's socket.io server. A client could open a session with one protocol revision and upgrade to WebSocket with another, and the server didn't check that they matched (GHSA-2gc4-cqfq-p2gv, DoS). socket.io 4.8.1 already allows engine.io ~6.6.0, so npm update engine.io moves it from 6.6.9 to 6.6.11 with a lockfile-only change. Installs of the published package already resolve 6.6.11 fresh, so this mostly brings our CI and dev installs in line and clears the alert. I've kept it here because it's a one-line security fix. The wider minor/patch updates from npm outdated will go in a separate PR so this one stays easy to review and revert.
vite^5.4.17 -> ^6.4.4 (devDependency). @vitejs/plugin-vue 5.2.4 and vite-plugin-pwa 1.0.0 already accept vite 6.
Override "vitepress": { ".": "$vitepress", "vite": "$vite" }. vitepress's vite follows the root version. The "." entry is needed because npm rejects a nested override on a direct dependency without it (EOVERRIDE).
Override "npm@<11.21.0": "11.21.0". Only npm copies below 11.21.0 match.
engine.io 6.6.9 -> 6.6.11 in the lockfile, within socket.io's existing ~6.6.0 range.
One commit per fix, so any of them can be dropped or bumped separately.
Alerts
Expected to clear (Dependabot decides after merge):
undici 6.28.0: GHSA-rfgv-xxqx-mfg5 (high, WebSocket subprotocol DoS) and GHSA-r53p-7pc4-xj5r (low). Inside npm only node-gyp uses undici, to download headers, and it doesn't touch WebSockets. Dependabot will still flag it.
npm's bundled brace-expansion goes from 2.0.2 to 5.0.9. Both versions are hit by the Sep 29 brace-expansion advisories, so this one isn't new exposure.
npm 11.21.1 (release PR npm/cli#10124, not published yet) bumps undici to 6.29.0, brace-expansion to 5.0.12, ip-address to 10.7.2 and postcss-selector-parser to 7.1.6. Once it's out and 12 hours old I'll move the override to it. If we'd rather not carry the undici alert in the meantime, drop the npm override commit and merge the other two.
Exit conditions
vitepress override: remove when we move to vitepress 2 (needs vite 8).
npm override: remove when the node-red devDependency moves to 5.x, since @node-red/registry 5 depends on npm 11 directly.
Release age and notes
vite 6.4.4: published 2026-10-06. Changelog checked. 6.4.3 is the fs.deny fix for Windows alternate paths, and 6.4.4 adds more server.fs hardening.
npm 11.21.0: published 2026-09-30. Same version Node-RED 5.0.8 ships.
engine.io 6.6.11: published 2026-09-24. Release notes checked. 6.6.10 rejects the protocol mismatch, and 6.6.11 refreshes the ping timeout on incoming packets. Maintainers unchanged.
Testing
On Node 24 / npm 11:
npm run build and npm run docs:build pass on vite 6.4.4
npm run lint: 0 errors, 3 existing warnings
npm test: 227 passing
Scratch Node-RED 4.1.16 with the built dashboard: page renders, button -> text round-trip works, a line chart draws live data, no browser console errors or warnings
On the same instance, the client upgrades from polling to WebSocket and receives chart messages over it, which is the engine.io path the advisory covers
Installed node-red-node-random through the palette API to exercise the registry's npm 11.21.0 install path
How to reproduce (or repeat for a similar alert)
Use Node 24 / npm 11, which is what CI runs.
# 1. Find who pulls the package in, and whether it's bundled
npm ls sigstore --all
npm explain vite
node -e "const l=require('./package-lock.json').packages;for(const k in l)if(/(^|\/)sigstore$/.test(k))console.log(k,l[k].version,l[k].inBundle?'bundled':'')"# 2. Bundled deps can't be overridden, so look for a parent version that bundles a fixed copy
curl -s https://unpkg.com/npm@11.21.0/node_modules/sigstore/package.json | grep '"version"'
curl -s https://unpkg.com/npm@11.21.0/node_modules/undici/package.json | grep '"version"'# check what else changes# 3. Release age (policy: at least 12 hours)
npm view vite time --json | grep 6.4.4
npm view npm time --json | grep 11.21.0
npm view engine.io time --json | grep 6.6.11
# 4. In-range fix: the parent's range already allows the fixed version, so no package.json change
npm update engine.io
# 5. Out-of-range fixes: edit package.json# devDependencies: "vite": "^6.4.4"# overrides: "vitepress": { ".": "$vitepress", "vite": "$vite" }# "npm@<11.21.0": "11.21.0"
npm install
# 6. Verify every copy is fixed and only the intended packages moved
npm ls vite npm sigstore engine.io --all
npm audit
@ben tagging you as reviewer for general OKness @n-lark tagging you as functional reviewer - since this touches vite/vite-press and socket.io your hawk eyes and thorough testing will know if anything should be dropped or changed.
Trivy flags this because of the npm@<11.21.0 override in this PR. That override fixes the bundled sigstore alert, but npm 11.21.0 bundles undici 6.28.0 (via node-gyp 12.4.0), and that undici version has a WebSocket DoS (fixed in 6.28.1). Alert: https://github.com/FlowFuse/node-red-dashboard/security/code-scanning/282
we can't patch it from this repo:
undici is a bundled dependency of npm (inBundle: true in the lockfile). It ships inside the npm tarball, so npm overrides don't apply to it. An undici override would not change anything.
11.21.0 is the latest npm 11 release. I don't want to move to npm 12 in this PR because of the changes to install script handling.
The real exposure is close to zero:
node-red is only a devDependency here, so this copy of npm never ships to users.
node-gyp is the only thing in npm that uses undici, and only for fetch (plus the HTTP agents) to download Node headers. The bug is in undici's WebSocket client, which nothing in the npm tree uses.
A fix is coming. On 2026-10-14 npm bumped its bundled undici to 6.29.0 on the release/v11 branch (npm/cli@fd105c78). Once that ships in the next npm 11 release, we can follow-up with a PR that bumps the npm@<...> override to that version. That will clear it!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Steve-Mcl
changed the title
Description
Clears the long-running Dependabot alerts our Vanta report keeps flagging, plus a high-severity runtime one I found while doing it.
Summary
vite. https://github.com/FlowFuse/node-red-dashboard/security/dependabot/189 has no fix on vite 5, so this moves us to vite 6.4.4. The old Dependabot PR (#2147, vite 6.4.3) couldn't clear it because vitepress 1.6.4 wants
vite ^5.4.14and kept its own nested vite 5. I've added a nested override so vitepress uses the root vite. vitepress 2 would fix it properly, but it's still alpha and needs vite 8.sigstore. https://github.com/FlowFuse/node-red-dashboard/security/dependabot/201 is not one of our deps. It sits inside the
npmpackage, which@node-red/registry4.1.x depends on (npm ^10.9.9), and npm bundles its own dependencies. An override can't reach a bundled dep. The only lever is npm's own version. npm 10.9.9 is the last 10.x and bundles sigstore 3.1.0, so I've overridden npm to 11.21.0. That's the exact version@node-red/registry5.0.8 pins, so Node-RED 5 already runs this combination.engine.io. https://github.com/FlowFuse/node-red-dashboard/security/dependabot/283 is high severity and, unlike the two above, in a runtime dependency. engine.io is the transport under the dashboard's socket.io server. A client could open a session with one protocol revision and upgrade to WebSocket with another, and the server didn't check that they matched (GHSA-2gc4-cqfq-p2gv, DoS). socket.io 4.8.1 already allows
engine.io ~6.6.0, sonpm update engine.iomoves it from 6.6.9 to 6.6.11 with a lockfile-only change. Installs of the published package already resolve 6.6.11 fresh, so this mostly brings our CI and dev installs in line and clears the alert. I've kept it here because it's a one-line security fix. The wider minor/patch updates fromnpm outdatedwill go in a separate PR so this one stays easy to review and revert.https://github.com/FlowFuse/node-red-dashboard/security/dependabot/276 (sharp) was already fixed on main by #2284.
Changes
vite^5.4.17->^6.4.4(devDependency).@vitejs/plugin-vue5.2.4 andvite-plugin-pwa1.0.0 already accept vite 6."vitepress": { ".": "$vitepress", "vite": "$vite" }. vitepress's vite follows the root version. The"."entry is needed because npm rejects a nested override on a direct dependency without it (EOVERRIDE)."npm@<11.21.0": "11.21.0". Only npm copies below 11.21.0 match.engine.io6.6.9 -> 6.6.11 in the lockfile, within socket.io's existing~6.6.0range.One commit per fix, so any of them can be dropped or bumped separately.
Alerts
Expected to clear (Dependabot decides after merge):
New, from npm 11.21.0's bundled tree:
npm 11.21.1 (release PR npm/cli#10124, not published yet) bumps undici to 6.29.0, brace-expansion to 5.0.12, ip-address to 10.7.2 and postcss-selector-parser to 7.1.6. Once it's out and 12 hours old I'll move the override to it. If we'd rather not carry the undici alert in the meantime, drop the npm override commit and merge the other two.
Exit conditions
node-reddevDependency moves to 5.x, since@node-red/registry5 depends on npm 11 directly.Release age and notes
Testing
On Node 24 / npm 11:
npm run buildandnpm run docs:buildpass on vite 6.4.4npm run lint: 0 errors, 3 existing warningsnpm test: 227 passingnode-red-node-randomthrough the palette API to exercise the registry's npm 11.21.0 install pathHow to reproduce (or repeat for a similar alert)
Use Node 24 / npm 11, which is what CI runs.
Related Issue(s)
https://github.com/FlowFuse/node-red-dashboard/security/dependabot/189
https://github.com/FlowFuse/node-red-dashboard/security/dependabot/201
https://github.com/FlowFuse/node-red-dashboard/security/dependabot/283
Checklist
flowforge.yml?FlowFuse/helmto update ConfigMap TemplateFlowFuse/CloudProjectto update values for Staging/ProductionLabels
area:migrationlabel