chore(deps): resolve 3 HIGH npm audit findings, apply quarantine-safe updates - #574
Merged
Merged
Conversation
… updates Audit (CVE exception to 14-day quarantine, fix versions verified): - socket.io-parser 4.2.6 -> 4.2.7 (GHSA-2m8v-j782-fhvr, production path; bumps our existing override) - nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8, dev-only via postcss; new override — postcss's floor does not force past the vulnerable version) - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895, dev-only via minimatch; lockfile refresh) Dev updates published on/before 2026-08-04: - @playwright/test 1.61.1 -> 1.62.1 - @typescript-eslint/{eslint-plugin,parser} 8.64.0 -> 8.66.0 - eslint 10.7.0 -> 10.8.0 - eslint-plugin-playwright 2.10.5 -> 2.11.0 - vitest / @vitest/coverage-v8 4.1.9 -> 4.1.10 - baseline-browser-mapping ^2.8.32 -> 2.11.12 (exact pin) - tsx ^4.22.4 -> 4.23.5 (exact pin) Deferred: majors (typescript 7, @types/node 26, better-sqlite3 13, basic-auth 3, eslint-plugin-unicorn 73) and anything newer than 14 days. SECURITY.md documents the three advisories and their exposure. npm audit --audit-level=high: 0 vulnerabilities.
…ssessments Trivy began flagging CVE-2026-69152 (brace-expansion 5.0.7) and CVE-2026-69192 (ip-address 10.2.0) on 2026-08-18. Both live in the global npm@11.18.0 pinned by the Dockerfile runtime stage, not the app tree, and no npm release vendors the fixed versions yet (checked through 11.19.0). Add both to .trivyignore, following the existing CVE-2026-14257 pattern, with matching SECURITY.md assessments and a re-evaluation trigger (bump the npm pin once a release vendors brace-expansion >= 5.0.9 and ip-address >= 10.3.1, then drop all three entries).
Owner
Author
|
CI |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit — 3 HIGH findings resolved (CVE exception to 14-day quarantine)
overridespin bumped^3.3.16doesn't force past it)Each fix version's maintainer/publisher was verified.
npm audit --audit-level=high→ 0 vulnerabilities. Assessments added toSECURITY.md.Applied updates (all published on/before 2026-08-04)
baseline-browser-mappingandtsxswitched to exact pins so a barenpm installcan't jump to disqualified latest versions.Deferred
Too new (< 14 days): @typescript-eslint 8.67.0, eslint 10.8.1, vitest 4.1.11, tsx 4.23.12, baseline-browser-mapping 2.11.15, eslint-plugin-n 18.3.0, @types/node 26.2.0, better-sqlite3 13.0.3.
Majors, not applied:
@typescript-eslintcompatibility.app/middleware/auth.middleware.ts:5needs a one-line change. Good next-cycle candidate.Overrides review
flatted,picomatch,path-to-regexp,qsappear vestigial (consumers already accept newer, no open advisories) — left as-is, candidates for cleanup.vite/lightningcssare deliberate quarantine pins.Verification
lint 0 errors (36 warnings, same as main) · typecheck clean · 1731 tests pass · build clean ·
npm audit --audit-level=highclean.