Repository navigation
fix(deps): resolve five transitive security alerts in the lockfile - #51
Merged
Merged
Conversation
Dependabot reports five open alerts on transitive build-time dependencies: brace-expansion 5.0.9 (#8, #9, #10, two high), via typedoc's minimatch; source-map-js 1.2.1 (#11, high), via the Vue compiler; and markdown-it 14.3.0 (#7), via typedoc. All are denial-of-service advisories triggered by crafted input. Every consumer's range already admits the patched version, so this is `pnpm update -r --depth Infinity` on the three packages and no override, the route #26 took for fast-uri. brace-expansion and source-map-js collapse onto versions the tree already had; markdown-it lands on 14.3.2, the latest patch. None of these reach a published package. typedoc's generated output is byte-identical to main's, so the markdown-it step changes no rendered docs. #12 (sprintf-js) has no patched release and stays open. Tags: #deps #security Co-Authored-By: htjulia <htjulia1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves five open Dependabot alerts on transitive build-time dependencies. The lockfile is the only file that changes.
brace-expansiontypedoc→minimatch10.2.6 (^5.0.8)source-map-js@vue/compiler-core,@vue/compiler-sfc(^1.2.1)markdown-ittypedoc(^14.3.0)All five are denial-of-service advisories triggered by crafted input: brace patterns, indexed
source maps, and linkified markdown.
How
pnpm update -r --depth Infinity brace-expansion source-map-js markdown-it, the same route#26 took for
fast-uri. Every consumer's range already admits the patched version, so nopnpm.overridesis added; an override would only leave a floor to remove later. Two of thethree just collapse onto a version the tree already had (
brace-expansion5.0.12 viaapi-extractor,
source-map-js1.2.2 via postcss), so the lockfile shrinks.markdown-itlands on 14.3.2, one patch past the advisory's 14.3.1, because that is thelatest release.
Exposure
None of these reach a published package.
brace-expansionandmarkdown-itrun only insidetools/docs(typedoc);source-map-jscomes in through the Vue compiler used by the devbuild and the demo.
@hexcanvas/vuetakesvueas a peer, so consumers resolve their owncopy and this lockfile does not reach them.
pnpm check:publishconfirms that all fivetarballs are publishable.
Not addressed
#12 (
sprintf-js<= 1.1.3, moderate) has no patched release. It arrives through@microsoft/api-extractor→@rushstack/ts-command-line→argparse1.0.10 (~1.0.2),so nothing can be done here until upstream moves.
Verification
pnpm install --frozen-lockfilepasses, and plainpnpm installleaves the lockfileunchanged
pnpm check: build, per-package checks, test typecheck, 391 tests passpnpm test:browser: 477 tests passpnpm api: all 5 API reports matchpnpm api:docs: the generated HTML and JSON are byte-identical to main's (diff -r), sothe markdown-it step does not change rendered docs
pnpm check:publish: all 5 packages publishable