fix(deps): clear 2 remaining high npm-audit GHSAs to unblock CI#151
Closed
timoa wants to merge 1 commit into
Closed
fix(deps): clear 2 remaining high npm-audit GHSAs to unblock CI#151timoa wants to merge 1 commit into
timoa wants to merge 1 commit into
Conversation
The previous fix (PR #150) cleared the 4 moderate advisories listed in TIM-14, but two high-severity advisories remained and broke 'pnpm audit --audit-level=high' in the PR check. This adds the two missing pnpm overrides to bring the audit back to zero high. - GHSA-gv7w-rqvm-qjhr — esbuild: missing binary integrity check in the Deno module enables RCE via NPM_CONFIG_REGISTRY. Vite 7.3.5 pins esbuild at 0.27.3, but the vulnerable code path is only the Deno entry point, which the extension build never uses. New top-level 'esbuild: >=0.28.1' override (0.27.3 -> 0.28.1). - GHSA-hmw2-7cc7-3qxx — form-data: CRLF injection in multipart field names and filenames (>=4.0.0 <4.0.6). The only consumer is @vscode/vsce's publish flow, which never builds multipart requests from untrusted input. New top-level 'form-data: >=4.0.6' override (4.0.5 -> 4.0.6). Result of 'pnpm audit --audit-level=high': 0 high, 0 critical. The remaining 2 advisories (1 low @babel/core, 1 moderate js-yaml) are below the high threshold and pass CI. Verification: - pnpm audit --audit-level=high: exit 0, no high/critical. - pnpm audit (full): 2 vulnerabilities (was 7), 1 low + 1 moderate. - pnpm test: 201/201 pass. - pnpm lint: clean. - pnpm run compile: tsc clean. - pnpm run webpack: production bundle builds successfully. Refs TIM-14 (follow-up to PR #150).
📝 WalkthroughWalkthroughTwo minimum version constraints are added to the ChangesDependency Version Overrides
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
No React Doctor issues found. 🎉 Reviewed by React Doctor for commit |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #151 +/- ##
=======================================
Coverage 94.13% 94.13%
=======================================
Files 10 10
Lines 290 290
Branches 105 105
=======================================
Hits 273 273
Misses 1 1
Partials 16 16 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pnpm-workspace.yaml (1)
36-37: ⚡ Quick winConsider adding inline comments documenting the GHSA references and rationale.
Following the precedent set by the
eslint>ajventry (lines 19-23), adding brief comments would help future maintainers understand why these overrides exist and when they might be safe to remove:
esbuild: GHSA-gv7w-rqvm-qjhr affects only the Deno entry point; the Node.js path remains safeform-data: GHSA-hmw2-7cc7-3qxx CRLF injection is unreachable in vsce's publish-time usage📝 Example documentation format
tmp: '>=0.2.6' + # GHSA-gv7w-rqvm-qjhr (esbuild): Deno-only vulnerability; Node.js path + # used by the extension build is unaffected. Override safe until Vite + # upstream updates (currently pins 0.27.3). esbuild: '>=0.28.1' + # GHSA-hmw2-7cc7-3qxx (form-data): CRLF injection unreachable in vsce's + # publish-time Marketplace operations. Override safe until vsce updates + # from 4.0.5. form-data: '>=4.0.6'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` around lines 36 - 37, Add inline comments to document the GHSA references and rationale for the esbuild and form-data dependency overrides in pnpm-workspace.yaml. For the esbuild entry, add a comment explaining that GHSA-gv7w-rqvm-qjhr affects only the Deno entry point while the Node.js path remains safe. For the form-data entry, add a comment explaining that GHSA-hmw2-7cc7-3qxx's CRLF injection vulnerability is unreachable in vsce's publish-time usage. Follow the same documentation format precedent established by the eslint>ajv entry to help future maintainers understand why these overrides exist and when they might be safe to remove.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pnpm-workspace.yaml`:
- Around line 36-37: Add inline comments to document the GHSA references and
rationale for the esbuild and form-data dependency overrides in
pnpm-workspace.yaml. For the esbuild entry, add a comment explaining that
GHSA-gv7w-rqvm-qjhr affects only the Deno entry point while the Node.js path
remains safe. For the form-data entry, add a comment explaining that
GHSA-hmw2-7cc7-3qxx's CRLF injection vulnerability is unreachable in vsce's
publish-time usage. Follow the same documentation format precedent established
by the eslint>ajv entry to help future maintainers understand why these
overrides exist and when they might be safe to remove.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7f57c3e4-9bbd-4247-99ef-7d88e8c54397
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
pnpm-workspace.yaml
Owner
Author
|
Superseded by the comprehensive TIM-16 fix. Closing this partial 2-of-4 advisory fix. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to PR #150 (already merged). The previous fix cleared the 4 moderate advisories listed in TIM-14, but two high-severity advisories remained and were breaking
pnpm audit --audit-level=highin the PR check. This adds the two missing pnpm overrides to bring the audit back to zero high.esbuildoverride >=0.28.1form-dataoverride >=4.0.6Why overrides, not direct dep bumps
@vscode/vsce, used only at publish time to talk to the VSCode Marketplace. It never builds multipart bodies from untrusted input, so the CRLF-injection path is unreachable. Override forces the patched version without waiting for a vsce release.Verification
pnpm audit --audit-level=high: exit 0, no high/critical advisories. CI unblocked.pnpm audit(full): 2 advisories remain (down from 7). Both below the high threshold:GHSA-4x5r-pxfx-6jf8(low) — @babel/core arbitrary file read viasourceMappingURL(transitive of @vitejs/plugin-react).GHSA-h67p-54hq-rp68(moderate) — js-yaml quadratic-complexity DoS in merge-key handling (transitive of @vscode/vsce>@secretlint/node>...>js-yaml).pnpm test: 201/201 pass (15 files, fast-check fuzz included).pnpm lint: clean.pnpm run compile: tsc clean.pnpm run webpack: production bundle builds successfully.Refs TIM-14.
Summary by CodeRabbit