fix(deps): resolve undici and yauzl security vulnerabilities #1768
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -49,7 +49,10 @@ | |
| "rollup@>=4.0.0 <4.59.0": ">=4.59.0", | ||
| "svgo@>=3.0.0 <3.3.3": "^3.3.3", | ||
| "ponder>@hono/node-server@<1.19.10": "^1.19.10", | ||
| "devalue@<5.6.4": "^5.6.4", | ||
| "undici@>=7.0.0 <7.24.0": "^7.24.0", | ||
| "undici@>=6.0.0 <6.24.0": "^6.24.0", | ||
| "yauzl@<3.2.1": "^3.2.1" | ||
|
shrugs marked this conversation as resolved.
Contributor
There was a problem hiding this comment. yauzl major-version override may silently break The override
yauzl.open(zipPath, { lazyEntries: true }, (err, zipfile) => { … })In yauzl@3.x the third argument is no longer a callback, so the callback is never invoked and no error is raised —
The only safe remediation paths are:
CI is also unchecked in the PR description, which is worth confirming before merging.
Comment on lines
+51
to
+55
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
lockfile="$(fd -HI '^pnpm-lock\.yaml$' | head -n1)"
if [ -z "${lockfile:-}" ]; then
echo "pnpm-lock.yaml not found"
exit 1
fi
python - <<'PY'
import re, sys
from pathlib import Path
from glob import glob
locks = glob("**/pnpm-lock.yaml", recursive=True)
if not locks:
print("pnpm-lock.yaml not found")
sys.exit(1)
text = Path(locks[0]).read_text(encoding="utf-8", errors="ignore")
bad = []
def tup(v): return tuple(int(x) for x in v.split("."))
for v in re.findall(r"/undici@(\d+\.\d+\.\d+)", text):
t = tup(v)
if (t[0] == 6 and t < (6, 24, 0)) or (t[0] == 7 and t < (7, 24, 0)):
bad.append(("undici", v))
for v in re.findall(r"/yauzl@(\d+\.\d+\.\d+)", text):
if tup(v) < (3, 2, 1):
bad.append(("yauzl", v))
for v in re.findall(r"/devalue@(\d+\.\d+\.\d+)", text):
if tup(v) < (5, 6, 4):
bad.append(("devalue", v))
if bad:
print("Found vulnerable resolved versions:", bad)
sys.exit(2)
print("No vulnerable resolved versions found for the checked packages.")
PYRepository: namehash/ensnode Length of output: 138 Lockfile not regenerated after overrides—critical vulnerability remains unresolved. The overrides in 🤖 Prompt for AI Agents |
||
| }, | ||
| "ignoredBuiltDependencies": [ | ||
| "bun" | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
devalueCVE not documented in PR descriptionA
devalue@<5.6.4: ^5.6.4override was added (fixing GHSA-vh2x-4mhp-swfc — prototype pollution via__defineGetter__) but the PR description only lists the threeundiciandyauzladvisories. This makes the audit trail incomplete. Consider adding thedevalueadvisory to the summary so it is tracked alongside the others.