Security advisories in the shipped RCL frontend package (incl. pdfjs-dist)

[deanleigh]

Summary

Enabling Dependabot (#36) immediately surfaced advisories in src/UpDoc/wwwroot/App_Plugins/UpDoc — the shipped RCL's frontend package. This was missed during the #36 scoping, which audited only docs/.

npm audit in that directory reports 10 vulnerabilities (3 moderate, 7 high).

Why this is a separate issue from #36

#36 was correctly scoped as docs-only and cannot affect consuming projects. This can. It touches the package that ships to the live client project, so it needs the #40 release-safety baseline in place first.

The findings split into two very different risk categories

Build-time only (does not ship)

devDependencies — present in the repo, absent from the published package:

Package	Severity	Direct?
vite	high	direct
rollup	high	transitive
esbuild	moderate	transitive
postcss	moderate	transitive
minimatch	high	transitive
brace-expansion	moderate	transitive

Dependabot has already opened PRs for four of these: #46 (postcss), #47 (brace-expansion), #48 (minimatch), #49 (vite 5 → 6, major).

Risk to consumers: none — these never reach a consuming site. Risk is to the build itself, and vite 5 → 6 is a major bump that could break the bundle.

Runtime, and genuinely shipped

Package	Severity	Direct?
pdfjs-dist	high	direct dependency
canvas	high	transitive (via pdfjs-dist)
@mapbox/node-pre-gyp	high	transitive
tar	high	transitive

pdfjs-dist is a real dependency, not a dev dependency. Confirmed shipped: dist/pdf.worker.min.mjs is 1.3MB of built output, produced by the copy:pdfworker build step and included in the package. It is used for PDF thumbnail rendering in the backoffice.

This is the one that matters. It reaches consuming projects, including the live one.

Current: pdfjs-dist ^4.2.67. The advisory covers 3.0.279 - 4.7.76 via its canvas dependency.

Open questions

• Is canvas actually reachable in the browser build? canvas is a Node-native module; pdf.js typically only uses it server-side, and the browser bundle may never touch that path. If so the practical severity drops sharply — but it needs confirming by inspecting the bundle, not assuming. Note the presence of __vite-browser-external-*.js in dist/, which suggests Vite is already externalising Node-only modules.
• What does upgrading pdfjs-dist cost? Check whether v5 changes the worker API used by up-doc-pdf-thumbnail.element.ts and up-doc-pdf-picker.element.ts.
• Take the Dependabot PRs as-is, or batch them? Bump vite from 5.4.21 to 6.4.3 in /src/UpDoc/wwwroot/App_Plugins/UpDoc in the npm_and_yarn group across 1 directory #49 (vite 5 → 6) is a major bump and should be verified against a full frontend build plus the E2E suite, not merged blind.

Done when

• Determined whether canvas/tar/node-pre-gyp are actually reachable in the shipped browser bundle
• pdfjs-dist upgraded, or a documented justification for not doing so
• Dev-dependency advisories cleared (Dependabot PRs Bump postcss from 8.5.6 to 8.5.26 in /src/UpDoc/wwwroot/App_Plugins/UpDoc in the npm_and_yarn group across 1 directory #46-Bump vite from 5.4.21 to 6.4.3 in /src/UpDoc/wwwroot/App_Plugins/UpDoc in the npm_and_yarn group across 1 directory #49 reviewed, not blind-merged)
• npm run build produces a working bundle; PDF thumbnails and the page picker still function
• E2E suite passes
• npm audit clean or remaining items justified

Sequencing

After #40 (release-safety baseline). This modifies the shipped package; the baseline is what demonstrates the import still works afterwards.

[deanleigh]

Triaged the Dependabot alert list while establishing a verification baseline. Recording it here so nobody repeats the work.

The headline "1 critical" is an unfetched optional transitive

GitHub reports 54 open alerts on main (1 critical, 23 high, 27 moderate, 3 low). The critical is:

• GHSA-23hp-3jrh-7fpw — node-tar: decompression/parse DoS via unlimited input
• tar 6.2.1, vulnerable <= 7.5.18, patched in 7.5.19
• Reported against src/UpDoc/wwwroot/App_Plugins/UpDoc/package-lock.json with scope: runtime

The chain is:

pdfjs-dist -> canvas (optional) -> @mapbox/node-pre-gyp (optional) -> tar 6.2.1

Three independent reasons it does not reach anyone:

1. Optional throughout. canvas is pdfjs-dist's native server-side rendering dependency. A browser build never needs it, so npm skips it.
2. Not installed. npm ls tar --all in App_Plugins/UpDoc returns (empty). It is a lockfile entry for a package that was never fetched to disk.
3. Build-time by nature. tar extracts archives during npm install. Nothing imports it, so Vite cannot bundle it.

UpDoc.csproj also removes node_modules/**, src/** and package-lock.json from the package. The shipped RCL contains dist/ and nothing else.

The scope: runtime label is npm's dependencies-vs-devDependencies split, not a statement about what executes in the browser. pdfjs-dist is correctly a runtime dependency; the vulnerable transitive under it is not.

What the 54 actually are

Every alert is npm. There are no NuGet alerts at all.

Manifest	Alerts	Reaches users?
src/UpDoc/wwwroot/App_Plugins/UpDoc	~28	Only dist/ ships; these are build tooling
mcp/	18	Not published yet
src/TailoredTravel.Web	6	Local mirror only
docs/	1	Static site

Recurring packages: tar, undici, vite, postcss, esbuild, rollup, minimatch, brace-expansion — build tooling and test helpers.

Suggested priority

Lower than the severity label implies. Worth doing as hygiene, and npm audit fix plus a pdfjs-dist bump would clear most of it, but nothing here is reaching a site running UpDoc.

Separately: dotnet build reports two NuGet advisories that Dependabot does not track — Microsoft.OpenApi 2.4.1 and SQLitePCLRaw.lib.e_sqlite3 2.1.11, both transitive, both high severity. Those are compile-time dependencies of shipped code, so arguably they matter more than anything in this list. Raised separately.