Skip to content

Update depenedncy versions as per security audit report #1784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tk-o merged 1 commit into from
Mar 18, 2026
Merged

Update depenedncy versions as per security audit report #1784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/ensadmin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
"graphiql": "5.2.0",
"graphql": "^16.10.0",
"lucide-react": "catalog:",
"next": "^16.1.5",
"next": "^16.1.7",
"next-themes": "^0.4.6",
"react": "19.2.1",
"react-dom": "19.2.1",
Expand Down
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,8 @@
"devalue@<5.6.4": "^5.6.4",
"undici@>=7.0.0 <7.24.0": "^7.24.0",
"undici@>=6.0.0 <6.24.0": "^6.24.0",
"yauzl@<3.2.1": "^3.2.1"
"yauzl@<3.2.1": "^3.2.1",
"fast-xml-parser@>=5.0.0 <=5.5.5": ">=5.5.6"
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Unconstrained override range for fast-xml-parser

The new override uses >=5.5.6 (no upper bound), while the four security overrides added immediately above (devalue, undici, yauzl) all use a caret range (^) to constrain the resolution to a compatible minor/patch version within the same major. Using >=5.5.6 would allow pnpm to resolve fast-xml-parser to a future 6.x or 7.x release if one is published, potentially pulling in breaking changes.

For consistency with the adjacent overrides and to avoid unexpected major-version upgrades, prefer:

Suggested change
"fast-xml-parser@>=5.0.0 <=5.5.5": ">=5.5.6"
"fast-xml-parser@>=5.0.0 <=5.5.5": "^5.5.6"

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect lockfile/package specs to confirm resolved major versions for fast-xml-parser.
fd '^pnpm-lock\.yaml$' --exec rg -n 'fast-xml-parser@'
rg -n '"fast-xml-parser@>=5\.0\.0 <=5\.5\.5"\s*:\s*".*"' --type json

Repository: namehash/ensnode

Length of output: 236

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check if pnpm has a catalog defined
echo "=== Checking for pnpm catalog in pnpm-lock.yaml ==="
rg -A 5 'catalog:' pnpm-lock.yaml | head -20

echo -e "\n=== Checking other overrides in package.json for patterns ==="
rg -B 1 -A 1 'overrides' package.json | head -30

echo -e "\n=== Examining pnpm-lock.yaml override section ==="
rg -B 3 -A 3 'fast-xml-parser@>=5\.0\.0' pnpm-lock.yaml

Repository: namehash/ensnode

Length of output: 1306

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Checking pnpm catalog definition in package.json ==="
rg -B 2 -A 10 '"catalog"' package.json

echo -e "\n=== Checking complete overrides section in package.json ==="
rg -B 1 -A 25 '"overrides"' package.json

echo -e "\n=== Verifying npm registry for fast-xml-parser versions ==="
# Check if fast-xml-parser has versions >= 6.0.0
rg 'fast-xml-parser' pnpm-lock.yaml | grep -E 'fast-xml-parser@[0-9]' | sort -u

Repository: namehash/ensnode

Length of output: 116

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Full overrides section in package.json ==="
cat package.json | jq '.pnpm.overrides' 2>/dev/null || rg -A 30 '"overrides"' package.json

echo -e "\n=== All versions of fast-xml-parser in pnpm-lock.yaml ==="
rg 'fast-xml-parser@' pnpm-lock.yaml | cut -d: -f1 | sort -u

echo -e "\n=== Check if >= constraint allows 6.x versions ==="
# Simulating semver: >=5.5.6 should match 5.5.6, 5.5.7, 5.6.0, 6.0.0, etc.
echo "Semver range '>=5.5.6' matches: 5.5.6, 5.5.7, 5.6.0, 6.0.0, 7.0.0, etc."
echo "Semver range '^5.5.6' matches: 5.5.6, 5.5.7, 5.6.0, but NOT 6.0.0+"

Repository: namehash/ensnode

Length of output: 1029

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Checking npm for fast-xml-parser versions (if available online) ==="
# Check git history for when this override was added - context on intent
git log -1 --oneline -- package.json | head -5

echo -e "\n=== Check if there's a pattern: comparing override patterns ==="
echo "Overrides that should constrain to same major version:"
rg '"(undici|tar|devalue|svgo)@' package.json
echo -e "\nOverrides with unbounded upper (>=):"
rg '"[^"]+@[^"]*":\s*">=(?!\^)' package.json

echo -e "\n=== Check catalog usage pattern ==="
rg 'catalog:' package.json | head -5

Repository: namehash/ensnode

Length of output: 812

🏁 Script executed:

#!/bin/bash
set -euso pipefail

echo "=== Check overrides with unbounded >= (PCRE2) ==="
rg -P '"[^"]+@[^"]*":\s*">=(?!\^)' package.json

echo -e "\n=== Alternative: grep for >= without ^ ==="
grep '">=' package.json | grep -v '\^'

echo -e "\n=== Show git log context on this override ==="
git show d738617:package.json | rg 'fast-xml-parser' || echo "Not in that commit"

Repository: namehash/ensnode

Length of output: 1114

🏁 Script executed:

#!/bin/bash
set -e

echo "=== Verify git commit added this override ==="
git log --all --oneline -- package.json | grep -i 'security\|audit' | head -3

echo -e "\n=== Check fast-xml-parser npm registry for actual available versions ==="
# Since we can't query npm directly, check if any 6.x exists in lockfile
rg 'fast-xml-parser@6\.' pnpm-lock.yaml || echo "No 6.x version found in current lockfile"

echo -e "\n=== Compare: does caret constraint exist elsewhere in same commit? ==="
git show d738617:package.json | grep -E '(tar|devalue|undici|svgo)@' | head -5

Repository: namehash/ensnode

Length of output: 667

🏁 Script executed:

#!/bin/bash
set -e

echo "=== Final verification: Check npm registry for fast-xml-parser current versions ==="
# Query public npm API to see if 6.x versions exist
curl -s 'https://registry.npmjs.org/fast-xml-parser' | jq '.versions | keys[] | select(startswith("6."))' 2>/dev/null | head -5 || echo "Unable to query, but check indicates: no 6.x in current lockfile"

echo -e "\n=== Confirm the override was added in same commit as caret-constrained ones ==="
git show d738617:package.json | jq '.pnpm.overrides | keys[] | select(test("(fast-xml-parser|tar|devalue|undici|svgo)"))' | sort

Repository: namehash/ensnode

Length of output: 362

Constrain the fast-xml-parser override to match the pattern of other security fixes.

Line 56 uses ">=5.5.6", which allows major version jumps. This is inconsistent with other security-related overrides in the same commit (tar, devalue, svgo, undici), which all use caret constraints (^) to limit resolution to compatible versions within the same major version.

Proposed change 
-      "fast-xml-parser@>=5.0.0 <=5.5.5": ">=5.5.6"
+      "fast-xml-parser@>=5.0.0 <=5.5.5": "^5.5.6"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"fast-xml-parser@>=5.0.0 <=5.5.5": ">=5.5.6"
"fast-xml-parser@>=5.0.0 <=5.5.5": "^5.5.6"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 56, Update the fast-xml-parser override to use a
caret-constrained version range like the other security fixes: change the
override value for the "fast-xml-parser@>=5.0.0 <=5.5.5" entry from ">=5.5.6" to
"^5.5.6" so resolution is limited to compatible 5.x releases within the same
major version.

},
"ignoredBuiltDependencies": [
"bun"
Expand Down
117 changes: 67 additions & 50 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading