fix(security): close open Dependabot vulnerability alerts - #1055
Conversation
Bump vulnerable dependencies across the monorepo to patched releases: - next 15.5.25 + sharp 0.35.4 (rag evaluation UI RCE / libheif) - js-yaml 4.3.2 (empty merge-source CPU DoS) - fast-uri 3.1.7 (host confusion / SSRF) - google.golang.org/grpc v1.83.2 (xDS authority DoS) - browserslist 4.28.9 + baseline-browser-mapping 2.11.23 - hono 4.13.7 (toSSG path traversal) - qs 6.16.0 (arrayLimit / isBuffer DoS) - vitest / @vitest/mocker 4.1.11 (redirect mock path traversal) Regenerated affected npm/pnpm lockfiles and go.sum. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
Performance
✓ No regressions detected |
Full npm install (not package-lock-only) so control-plane web client and desktop locks include all transitive deps required by npm ci. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
📊 Coverage gateThresholds from
✅ Gate passedNo surface regressed past the allowed threshold and the aggregate stayed above the floor. |
📐 Patch coverage gateThreshold: 80% on lines this PR touches vs
✅ Patch gate passedEvery surface whose lines were touched by this PR has patch coverage at or above the threshold. |
|
@AbirAbbas CI is green on this PR (40/40). Please review and merge when you have a moment. Covers the selected Dependabot alerts (next/sharp RCE, js-yaml, fast-uri, grpc, browserslist, baseline-browser-mapping, hono, qs, vitest). Local + CI verified. |
- @humanfs/node 0.16.8 (pnpm lock still had 0.16.7 symlink copy) - postcss-selector-parser 6.1.4 (pnpm lock still had 6.1.2 AST DoS) - @ai-sdk/provider-utils 4.0.51 including v5/v6 aliases (resource consumption) Vitest 4.1.11, hono 4.13.7, and esbuild 0.28.1 were already patched on this branch for the related alerts. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
|
@AbirAbbas added the remaining selected alerts to this same PR (vitest/hono were already covered; new: Please re-review after CI goes green on |
|
@AbirAbbas CI is green again on |
AbirAbbas
left a comment
AbirAbbas
left a comment
There was a problem hiding this comment.
Verified on the merge with current main rather than trusting the green checks. Walked every open Dependabot alert against the exact lock entries on this branch: all 33 in scope resolve at or above the fixed version (next 15.5.25, sharp 0.35.4, js-yaml 4.3.2 in all four locks, fast-uri 3.1.7, hono 4.13.7, qs 6.16.0, vitest/@vitest/mocker 4.1.11 everywhere, @humanfs/node 0.16.8, browserslist 4.28.9, baseline-browser-mapping 2.11.23, postcss-selector-parser 6.1.4, esbuild 0.28.1, provider-utils 4.0.51, grpc 1.83.2). The only ones left open are the four low otel ones, which #1060 covers. The npm and pnpm web locks agree on every bumped version.
Gates: npm ci is clean in all five package dirs (that's the check that catches lock drift), web-ui and sdk-typescript coverage surfaces pass with real test counts, web build, desktop typecheck + tests, the rag-evaluation Next build, control-plane build/vet/test surface, and go mod tidy leaves go.mod/go.sum untouched. Go pins match #1060 exactly, so whichever lands second just needs a textual go.mod merge.
One non-blocking thing, not worth holding this up: control-plane/web/client/pnpm-lock.yaml was regenerated with pnpm 10, which writes an overrides: block into the lock; pnpm 12 ignores package.json#pnpm.overrides, so pnpm install --frozen-lockfile on pnpm 12 now fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Main has the mirror-image problem (its lock fails frozen on pnpm 10), and nothing in CI runs pnpm at all, so this only affects someone hand-running pnpm locally. Worth a follow-up to either drop that lock (it exists only to generate duplicate Dependabot alerts) or move the overrides to pnpm-workspace.yaml where both majors read them.
Also from npm audit but outside the alert list: desktop still carries tar 7.5.20 (GHSA-r292-9mhp-454m, high) and sdk/typescript diff 4.0.2 (GHSA-73rr-hh4g-fpgx, low), both unchanged from main.
3 participants
Summary
Single PR that upgrades the packages behind the selected open Dependabot alerts so they can auto-close once merged.
@AbirAbbas — please review and merge once CI is green.
Critical
next(rag evaluation UI)15.5.22→15.5.25(Windows RCE + AVIF Image Optimization RCE)sharp(rag evaluation UI)0.35.3→0.35.4(libheif GHSA-g89c-p67h-r497 / GHSA-2jg2-4ch7-h545)High
js-yaml(web client, desktop, mastra-bench)4.3.1→4.3.2(empty merge-source CPU DoS)fast-uri(desktop, mastra-bench)3.1.5→3.1.7(host confusion / SSRF)google.golang.org/grpc(control-plane)v1.83.1→v1.83.2(xDS missing:authority/HostDoS)browserslist(web client)4.28.9(normalizeStatsprototype write)Moderate
baseline-browser-mapping(web client)2.11.23(invalid input process termination)hono(mastra-bench)4.12.34→4.13.7(toSSG()traversal, fragment query parse, unboundedparseBody())qs(sdk/typescript)6.16.0(arrayLimit bypass + isBuffer DoS)vitest/@vitest/mocker(desktop, web client, sdk/typescript)4.1.11(redirect mock path traversal)@humanfs/node(web client pnpm)0.16.7→0.16.8(symlink recursive copy)Low
@ai-sdk/provider-utils(mastra-bench)4.0.51including v5/v6 aliases (resource consumption)postcss-selector-parser(web client pnpm)6.1.2→6.1.4(AST recursion DoS)esbuild(web client)0.28.1(patched floor for Windows servedir file read)Overrides were bumped in each affected
package.json, then lockfiles were regenerated with fullnpm install/pnpm install --lockfile-only(verifiednpm cilocally for web client + desktop).go get google.golang.org/grpc@v1.83.2 && go mod tidyrefreshed relatedgolang.org/x/*indirects required by grpc.Local verification
desktop: vitest 668/668 passed on 4.1.11;npm ciOKsdk/typescript: vitest 970/970 passed on 4.1.11;npm ciOKcontrol-planeweb client:npm ciOK after lockfile regenerationcontrol-plane:go build ./...OK;go test ./internal/config/...OKnpm ciOK; mastranpm auditclean after provider-utils bumpType of change