Clear remaining high-severity audit findings across the examples - #107
Open
miguelcalderon wants to merge 7 commits into
Open
Clear remaining high-severity audit findings across the examples#107miguelcalderon wants to merge 7 commits into
miguelcalderon wants to merge 7 commits into
Conversation
Overrides written by `pnpm audit --fix=override` invalidate the virtual store, so the follow-up `pnpm install` purges node_modules and asks for confirmation first. The audit and bump scripts capture pnpm's output, so the prompt was invisible and the run hung until someone blindly answered it; in CI it aborted with ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY. pnpm derives confirmModulesPurge internally, so no rc key or pnpm_config_* variable turns it off. Pass the setting on the command line instead, from one shared array all three pnpm install callers use. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds overrides for @sveltejs/kit, brace-expansion, browserslist and nanoid in the two pnpm examples, which could not be fixed before because the install stalled on the modules-purge prompt, and refreshes the npm lockfiles. svelte-kit and vue-composition-api now audit clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Move @electron/packager to ^20.3.0 and electron to ^44.2.0 in both Electron examples, clearing all remaining npm audit findings there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 🔮 View transcript: https://nutrient-agentlogs.dev/s/gx2n3lm6ht53az1s3d1r7rje
Bump the Angular packages to ^21.2.22 and the Angular CLI/devkit to ^21.2.23, covering GHSA-jhpw-976m-542j (HttpTransferCache cache-key ambiguity) and GHSA-jj27-h5hq-8x99 (i18n XSS via event-handler attributes). Add a `less` override so @angular-devkit/build-angular resolves less 4.9.1, which no longer depends on the vulnerable image-size (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq). Also add a decode-uri-component override to the Gatsby example for GHSA-vcc3-ghjq-m6fr. Both examples build clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 🔮 View transcript: https://nutrient-agentlogs.dev/s/gx2n3lm6ht53az1s3d1r7rje
Two selectors covered the same package: the older `<=2.69.0` line and the `<=2.70.1` line that raises the floor to 2.70.2. A version matching both leaves the effective floor to whichever override pnpm applies first, so the install could settle below 2.70.2. The wider selector subsumes the older one, so keep only that. Resolution stays at 2.70.3. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Two new qs advisories (array-limit bypass via bracket-key comma parsing, and DoS via attacker-controlled isBuffer) cover everything below 6.16.0. body-parser and express both pin `~6.15.1`, so an override is the only way to reach 6.16.0 without a major bump of express. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears the outstanding
npm/pnpm auditfindings across the examples. After this branch, every example reports zero high or critical severity findings.Highlights:
Electron / Electron (nodeIntegration) —
@electron/packager→^20.3.0,electron→^44.2.0. Both now audit clean.Angular — Angular packages →
^21.2.22, CLI/devkit →^21.2.23, covering:HttpTransferCachecache-key ambiguity leading to cross-request response reusePlus a
less: ^4.9.1override so@angular-devkit/build-angularstops pulling the vulnerableimage-size(GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) —lessdropped that dependency in 4.7.0.Gatsby —
decode-uri-component: ^0.5.0override for GHSA-vcc3-ghjq-m6fr (16 → 14 moderate).Laravel / React —
qs: ^6.16.0override for two advisories published after this branch opened: array-limit bypass via bracket-key comma parsing, and DoS via attacker-controlledisBuffer. Both cover everything<6.16.0;body-parserandexpresseach pin~6.15.1, sonpm audit fixwould have forced anexpressmajor — the override reaches 6.16.0 without touching either direct dependency.Earlier commits on the branch apply the broader audit sweep and stop
pnpm installstalling on the modules-purge prompt.Audit status after this branch
file-typeonly)ellipticonly)webpack-dev-serveronly)Known-unfixable leftovers
file-type(gatsbyjs, moderate — GHSA-5v7r-6r5c-r473): the fixed release is22.x, which is ESM-only with a changed API. Overriding it inside Gatsby's transitive tree breaks the build, so it stays.elliptic(laravel, low): reachable only throughlaravel-mix, and the only advertised fix is alaravel-mixmajor.webpack-dev-server(react, moderate):react-scripts@5pins^4.6.0and calls theonBeforeSetupMiddleware/onAfterSetupMiddlewarehooks that v5 removed, so an override to^5breaksnpm start. Dev-server only, never shipped.Type
Checklist
pnpm run formatpasses (Biome) — enforced by the pre-commit hookstartandstart:e2escripts inpackage.json— unchangedSERVER_DIR=examples/<name> pnpm run testpasses (Playwright smoke test) — not yet runREADME.mdincluded with prerequisites, setup, and usage — unchanged@nutrient-sdk/viewerversion — unchanged (1.21.0)Dependency-only change;
ng build(Angular) andgatsby build(Gatsby) both succeed locally.🤖 Generated with Claude Code