fix(deps): resolve high-severity prod audit advisories (hono, protobufjs)#178
fix(deps): resolve high-severity prod audit advisories (hono, protobufjs)#178ankitvgupta wants to merge 1 commit into
Conversation
…fjs) The Security Audit CI job (`npm audit --omit=dev --audit-level=high`) was failing on every PR due to pre-existing high-severity advisories in the production dependency tree (#176). Red on every PR desensitizes reviewers and can mask a genuinely new vulnerability. Scoped, in-range lockfile-only fix (no package.json range changes, no breaking majors): - hono 4.12.18 → 4.12.25 — HIGH (transitive via @modelcontextprotocol/sdk); fixes CORS/cookie/JWT/path-traversal advisories. - posthog-js 1.364.1 → 1.387.0 — newer posthog-js no longer depends on the @opentelemetry/* OTLP log-exporter chain, which orphans and removes protobufjs (HIGH) plus the @opentelemetry/core moderates entirely. The app never used the OTLP exporter (no opentelemetry/protobufjs references in src/); captureException uses PostHog's native $exception_list path. - dompurify 3.4.0 → 3.4.10, js-yaml 4.1.1 → 4.2.0, markdown-it 14.1.1 → 14.2.0, nodemailer 8.0.5 → 8.0.11, qs 6.15.0 → 6.15.2 — prod moderates, all fixed in-range in the same pass. After this, `npm audit --omit=dev` reports 0 vulnerabilities (all severities). The dompurify advisories target IN_PLACE / addHook / Trusted-Types usage; the app uses standard string-in/string-out sanitize with a static ALLOWED_TAGS config, so the bump is a pure security gain with no behavior change. Remaining 13 high are dev-only (electron-builder/node-gyp toolchain), do not gate CI, and require breaking majors — tracked separately, out of scope here. Verified: npm ci reproduces the lock, prod gate clean, typecheck + lint + format + build + unit (1425) + integration (18) all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
No reviewable files after applying ignore patterns. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
✅ Pre-PR verification — PASS
Agentic verification — summaryAgentic verification — verify-diff
SummaryThe PR is a package-lock.json-only dependency update. The most user-visible change was dompurify 3.4.0→3.4.10 (HTML email sanitization). I verified: (1) the app loads correctly, (2) an HTML email with inline image content renders properly via DOMPurify (colored placeholder blocks and formatted text all visible), (3) the sender sidebar populates correctly, (4) Escape-back navigation returns to the inbox with the correct focused row state, and (5) no console errors or error boundary triggers were observed. All existing core flows are unaffected by the lockfile update. Agentic verification — literal trace[2026-06-17T02:04:30.292Z] text: No console errors. Sender sidebar showing "Surbhi Sarna" correctly. Now let me press Escape/Back and verify the detail view closes and we return to the inbox properly. {"visibleErrors":[]}[2026-06-17T02:04:35.454Z] text: No visible errors. Now I'll click Back to return to the inbox and verify clean state. {"selectedRows":1,"senderName":"Surbhi Sarna","emptySidebar":false,"pageTitle":"Exo","bodyContainsError":false}[2026-06-17T02:05:12.287Z] text: Everything looks clean. The single Summary of what I verified:
{"verdict":"pass","summary":"The PR is a package-lock.json-only dependency update. The most user-visible change was dompurify 3.4.0→3.4.10 (HTML email sanitization). I verified: (1) the app loads correctly, (2) an HTML email with inline image content renders properly via DOMPurify (colored placeholder blocks and formatted text all visible), (3) the sender sidebar populates correctly, (4) Escape-back navigation returns to the inbox with the correct focused row state, and (5) no console errors or error boundary triggers were observed. All existing core flows are unaffected by the lockfile update.","anomalies":[],"actions_taken":11} |
1 participant
Summary
Fixes #176. The Security Audit CI job (
npm audit --omit=dev --audit-level=high) was failing on every PR due to pre-existing high-severity advisories in the production dependency tree (hono,protobufjs). A perpetually-red check desensitizes reviewers and can mask a genuinely new vulnerability.This is a scoped, in-range, lockfile-only fix —
package.jsonis unchanged (no dependency range changes, no breaking majors). After it,npm audit --omit=devreports 0 vulnerabilities across all severities (not just the highs).Changes (
package-lock.jsononly)@modelcontextprotocol/sdk; fixes CORS/cookie/JWT/path-traversal advisories@opentelemetry/*OTLP log-exporter chain → removesprotobufjs(HIGH) + the@opentelemetry/coremoderates entirelyqs.stringifyDoSNet diff: 64 insertions / 380 deletions — the bulk is the removed, unused
@opentelemetry/*+@protobufjs/*subtree.Why dropping the OpenTelemetry chain is safe
posthog-js@1.387.0dropped@opentelemetry/*as direct deps (1.364.1 declared five of them). The app never used the OTLP log exporter — there are noopentelemetry/otlp/protobufjsreferences anywhere insrc/, andcaptureExceptionuses PostHog's native$exception_listerror-tracking path (independent of OTLP). Session recording and analytics are unaffected.Why the dompurify bump is a pure security gain
The 3.4.x advisories all target
IN_PLACEmode,addHookmutation, and Trusted-Types output. The app uses standard string-in/string-outDOMPurify.sanitize(html, config)with a staticALLOWED_TAGSlist and none of those options — so the bump tightens edge-case security with no behavior change to email rendering.Out of scope
npm audit(full, incl. dev) still reports 13 high in the dev-only toolchain (electron-builder→node-gyp→make-fetch-happen/cacache/tar). These do not gate CI (which uses--omit=dev) and require breaking majors. Tracked separately.Verification
npm cireproduces the lockfile cleanly; dev deps intactnpm audit --omit=dev --audit-level=high→ 0 vulnerabilities (exit 0)npm run typecheck,npm run lint,npm run format:checknpm run buildmainbefore this change, so unrelated to this diff; these pass in CI (headless Linux + xvfb).Pre-PR verdict: PASS
fullad83529