fix(deps): resolve 4 moderate npm-audit GHSAs (TIM-14) by timoa · Pull Request #150 · timoa/workflow-editor

timoa · 2026-06-15T19:27:44Z

Summary

Resolves the 4 moderate advisories listed in the audit issue (TIM-14) by tightening two existing pnpm overrides and adding two new top-level ones. No source-code changes.

GHSA	Package	Old	New	Mechanism
GHSA-jxxr-4gwj-5jf2	brace-expansion	5.0.5	5.0.6	bump `minimatch>brace-expansion` to >=5.0.6
GHSA-q8mj-m7cp-5q26	qs	6.15.0	6.15.2	bump `qs` to >=6.15.2
GHSA-qx2v-qp2m-jg93	postcss	8.5.9	8.5.15	new `postcss` override >=8.5.10
GHSA-w5hq-g745-h8pq	uuid	8.3.2	14.0.0	new `uuid` override >=11.1.1

Why pnpm overrides

All four advisories are in transitive dependencies (vsce>glob>minimatch>brace-expansion, vsce>typed-rest-client>qs, @tailwindcss/postcss>postcss, vsce>@azure/identity>@azure/msal-node>uuid), so the only safe path is to force the patched range from the workspace. Direct version bumps in the lockfile are reverted by pnpm install.

uuid@>=11.1.1 is the only major-version jump. The consumer is @azure/msal-node, a transitive of @vscode/vsce (build/publish tool only, not bundled in the extension runtime). msal uses uuid v4; v4's public API is unchanged between uuid 8 and 14, and v14 is dual CJS/ESM, so the upgrade is API-compatible.

Verification

pnpm audit: the four target GHSAs are gone. Total advisories 11 -> 7. The remaining 7 (vite, esbuild, js-yaml, @babel/core, form-data, etc.) are not in scope for this issue.
pnpm test: 201/201 pass (15 files, fast-check property-based fuzz included).
pnpm lint: clean.
pnpm run compile: tsc clean.
pnpm run webpack: production bundle builds successfully.

Out of scope (7 remaining advisories)

vite (high, GHSA-fx2h-pf6j-xcff; moderate, GHSA-v6wh-96g9-6wx3), esbuild (low, GHSA-g7r4-m6w7-qqqr; high, GHSA-gv7w-rqvm-qjhr), js-yaml (moderate, GHSA-h67p-54hq-rp68), @babel/core (low, GHSA-4x5r-pxfx-6jf8), form-data (high, GHSA-hmw2-7cc7-3qxx). Each needs a separate audit/issue — they involve direct dep bumps (e.g. vite ^7.3.2 -> ^7.3.5) and were not in the scope of TIM-14.

Closes TIM-14.

Summary by CodeRabbit

Chores
- Updated dependency version pins for several packages including qs, minimatch, postcss, and uuid to ensure compatibility and stability.

Bump existing overrides and add two new ones to clear the four moderate advisories reported by the audit issue (TIM-14): - GHSA-jxxr-4gwj-5jf2 — brace-expansion ReDoS via numeric range. Bump 'minimatch>brace-expansion' from >=5.0.5 to >=5.0.6. (juliangruber/brace-expansion 5.0.5 -> 5.0.6) - GHSA-q8mj-m7cp-5q26 — qs.stringify DoS on null/undefined entries with arrayFormat:'comma' and encodeValuesOnly:true. Bump 'qs' from >=6.14.2 to >=6.15.2. (ljharb/qs 6.15.0 -> 6.15.2) - GHSA-qx2v-qp2m-jg93 — PostCSS XSS via unescaped </style> in stringified CSS. Add a top-level 'postcss' override >=8.5.10. (postcss 8.5.9 -> 8.5.15; direct dep already at 8.5.15, this pulls every transitive postcss-modules-* / @tailwindcss/postcss instance above the patched floor) - GHSA-w5hq-g745-h8pq — uuid v3/v5/v6 silent out-of-bounds write when a caller-supplied buffer is too small. Add a top-level 'uuid' override >=11.1.1. (uuid 8.3.2 -> 14.0.0; the consumer is @azure/msal-node, a transitive of the @vscode/vsce build tool which only runs at publish time and uses uuid v4, API-compatible with the override) Pattern mirrors the previous npm-audit fix in PR #144 (migrate overrides into pnpm-workspace.yaml, leave package.json untouched, regenerate the lockfile). Verification: - pnpm audit: the four target GHSAs are gone (11 -> 7 advisories; the remaining 7 are out of scope for this issue). - pnpm test: 201/201 pass (15 files, fast-check fuzz included). - pnpm lint: clean. - pnpm run compile: tsc clean. - pnpm run webpack: production bundle builds successfully.

coderabbitai · 2026-06-15T19:27:58Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a6372785-1558-46aa-b0a7-466db6464332

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

Four package version floors in pnpm-workspace.yaml overrides are bumped: qs to >=6.15.2, minimatch>brace-expansion to >=5.0.6, postcss to >=8.5.10, and uuid to >=11.1.1.

Changes

Dependency Override Bumps

Layer / File(s)	Summary
Version constraint updates `pnpm-workspace.yaml`	Raises minimum version floors for `qs` (6.14.2→6.15.2), `minimatch>brace-expansion` (5.0.5→5.0.6), `postcss` (8.5.0→8.5.10), and `uuid` (→11.1.1) in the `overrides` section.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

timoa/workflow-editor#144: Both PRs modify pnpm-workspace.yaml pnpm.overrides version pinning, including the minimatch/brace-expansion override.

Suggested labels

released

Poem

🐰 A hop, a skip, a version bump,
Four packages cleared the dependency hump!
qs and postcss got a little raise,
uuid and brace-expansion join the craze.
The lockfile's tidy, the rabbit's pleased —
Fresher pins keep the warren at ease! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly describes the main change: resolving npm-audit GHSAs through dependency updates, with a specific issue reference (TIM-14).
Description check	✅ Passed	The description provides comprehensive context including a summary table, detailed rationale for using pnpm overrides, verification results, and scope clarification, exceeding template requirements.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/npm-audit-4-ghsa

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-15T19:28:30Z

No React Doctor issues found. 🎉

_{Reviewed by React Doctor for commit 1a06e1b.}

codecov · 2026-06-15T19:29:50Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (f585982) to head (1a06e1b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #150   +/-   ##
=======================================
  Coverage   94.13%   94.13%           
=======================================
  Files          10       10           
  Lines         290      290           
  Branches      105      105           
=======================================
  Hits          273      273           
  Misses          1        1           
  Partials       16       16

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

timoa-bot · 2026-06-16T08:19:07Z

🎉 This PR is included in version 1.2.46 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Merge branch 'main' into fix/npm-audit-4-ghsa

1a06e1b

timoa merged commit 21d2b67 into main Jun 15, 2026
9 of 10 checks passed

timoa deleted the fix/npm-audit-4-ghsa branch June 15, 2026 20:28

This was referenced Jun 15, 2026

fix(deps): clear 2 remaining high npm-audit GHSAs to unblock CI #151

Closed

fix(deps): apply 4 security advisories via pnpm overrides (TIM-16) #152

Merged

timoa-bot Bot added the released label Jun 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): resolve 4 moderate npm-audit GHSAs (TIM-14)#150

fix(deps): resolve 4 moderate npm-audit GHSAs (TIM-14)#150
timoa merged 2 commits into
mainfrom
fix/npm-audit-4-ghsa

timoa commented Jun 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

github-actions Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

timoa-bot Bot commented Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

timoa commented Jun 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why pnpm overrides

Verification

Out of scope (7 remaining advisories)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

github-actions Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

timoa-bot Bot commented Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

timoa commented Jun 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

github-actions Bot commented Jun 15, 2026 •

edited

Loading

codecov Bot commented Jun 15, 2026 •

edited

Loading