fix(security): close open Dependabot vulnerability alerts - #1055
santoshkumarradha wants to merge 3 commits into
Conversation
Bump vulnerable dependencies across the monorepo to patched releases: - next 15.5.25 + sharp 0.35.4 (rag evaluation UI RCE / libheif) - js-yaml 4.3.2 (empty merge-source CPU DoS) - fast-uri 3.1.7 (host confusion / SSRF) - google.golang.org/grpc v1.83.2 (xDS authority DoS) - browserslist 4.28.9 + baseline-browser-mapping 2.11.23 - hono 4.13.7 (toSSG path traversal) - qs 6.16.0 (arrayLimit / isBuffer DoS) - vitest / @vitest/mocker 4.1.11 (redirect mock path traversal) Regenerated affected npm/pnpm lockfiles and go.sum. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
Performance
✓ No regressions detected |
Full npm install (not package-lock-only) so control-plane web client and desktop locks include all transitive deps required by npm ci. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
📊 Coverage gateThresholds from
✅ Gate passedNo surface regressed past the allowed threshold and the aggregate stayed above the floor. |
📐 Patch coverage gateThreshold: 80% on lines this PR touches vs
✅ Patch gate passedEvery surface whose lines were touched by this PR has patch coverage at or above the threshold. |
|
@AbirAbbas CI is green on this PR (40/40). Please review and merge when you have a moment. Covers the selected Dependabot alerts (next/sharp RCE, js-yaml, fast-uri, grpc, browserslist, baseline-browser-mapping, hono, qs, vitest). Local + CI verified. |
- @humanfs/node 0.16.8 (pnpm lock still had 0.16.7 symlink copy) - postcss-selector-parser 6.1.4 (pnpm lock still had 6.1.2 AST DoS) - @ai-sdk/provider-utils 4.0.51 including v5/v6 aliases (resource consumption) Vitest 4.1.11, hono 4.13.7, and esbuild 0.28.1 were already patched on this branch for the related alerts. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
|
@AbirAbbas added the remaining selected alerts to this same PR (vitest/hono were already covered; new: Please re-review after CI goes green on |
|
@AbirAbbas CI is green again on |
2 participants
Summary
Single PR that upgrades the packages behind the selected open Dependabot alerts so they can auto-close once merged.
@AbirAbbas — please review and merge once CI is green.
Critical
next(rag evaluation UI)15.5.22→15.5.25(Windows RCE + AVIF Image Optimization RCE)sharp(rag evaluation UI)0.35.3→0.35.4(libheif GHSA-g89c-p67h-r497 / GHSA-2jg2-4ch7-h545)High
js-yaml(web client, desktop, mastra-bench)4.3.1→4.3.2(empty merge-source CPU DoS)fast-uri(desktop, mastra-bench)3.1.5→3.1.7(host confusion / SSRF)google.golang.org/grpc(control-plane)v1.83.1→v1.83.2(xDS missing:authority/HostDoS)browserslist(web client)4.28.9(normalizeStatsprototype write)Moderate
baseline-browser-mapping(web client)2.11.23(invalid input process termination)hono(mastra-bench)4.12.34→4.13.7(toSSG()traversal, fragment query parse, unboundedparseBody())qs(sdk/typescript)6.16.0(arrayLimit bypass + isBuffer DoS)vitest/@vitest/mocker(desktop, web client, sdk/typescript)4.1.11(redirect mock path traversal)@humanfs/node(web client pnpm)0.16.7→0.16.8(symlink recursive copy)Low
@ai-sdk/provider-utils(mastra-bench)4.0.51including v5/v6 aliases (resource consumption)postcss-selector-parser(web client pnpm)6.1.2→6.1.4(AST recursion DoS)esbuild(web client)0.28.1(patched floor for Windows servedir file read)Overrides were bumped in each affected
package.json, then lockfiles were regenerated with fullnpm install/pnpm install --lockfile-only(verifiednpm cilocally for web client + desktop).go get google.golang.org/grpc@v1.83.2 && go mod tidyrefreshed relatedgolang.org/x/*indirects required by grpc.Local verification
desktop: vitest 668/668 passed on 4.1.11;npm ciOKsdk/typescript: vitest 970/970 passed on 4.1.11;npm ciOKcontrol-planeweb client:npm ciOK after lockfile regenerationcontrol-plane:go build ./...OK;go test ./internal/config/...OKnpm ciOK; mastranpm auditclean after provider-utils bumpType of change