Repository navigation
fix(security): clear the last 3 criticals (proxy-addr IP spoofing, tinypool RCE) - #27
Merged
Merged
Conversation
XSS sanitizer bypass in DOM.sanitize() via Live NamedN... No patch exists in 5.x; the advisory requires 6.14.0. v6 removed the default export. MapContainer imports Map as MapLibreMap because the module also uses the built-in Map, and a bare Map import would shadow it. basemap-styles takes addProtocol directly. Call-site behaviour is unchanged; only the import form. typecheck pass, lint pass, build pass, npm audit critical 1 -> 0. test:data: 401 failures, identical set to main after building both (verified with a worktree at origin/main; set difference empty in both directions).
…nypool RCE) All were in consumer-prices-core/ plus the root vitest. consumer-prices-core: - proxy-addr 2.0.7 -> 2.0.8 via the existing overrides block (it arrives transitively through fastify@^4); this is the critical IP-spoofing advisory - vitest 3.2.6 -> 5.0.4, which drops tinypool from the tree entirely - non-breaking npm audit fix resolutions: fast-uri, js-yaml, nanoid, postcss, source-map-js (lockfile only) - npm audit 3 critical / 11 total -> 0 critical / 3 total root workspace: vitest 4.1.0 -> 5.0.4 and @vitest/coverage-v8 likewise, dropping tinypool from that tree too. typecheck pass, lint pass, test:data unchanged at 9714/401, test:convex 328 pass, consumer-prices-core 54 pass.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the last 3 criticals in this repo —
proxy-addr(IP spoofing) and twotinypoolprototype-pollution-to-RCE advisories. All were inconsumer-prices-core/, plus the root workspace's vitest.What changed
consumer-prices-core/proxy-addroverridesvitesttinypoolnpm auditproxy-addrarrives transitively throughfastify@^4, so it is pinned in the existingoverridesblock — the same mechanism already used there forwsandform-data.The five non-breaking
npm audit fixresolutions (fast-uri,js-yaml,nanoid,postcss,source-map-js) are lockfile-only.root workspace —
vitest4.1.0 → 5.0.4 and@vitest/coverage-v8likewise, which dropstinypoolfrom the tree.Verification
npm run typechecknpm run lintnpm run test:datanpm run test:convexconsumer-prices-corenpm testThe 401 in
test:dataare the same pre-existing set documented in #23 and #26; the vitest bump adds none.Two things I did not touch
fastify4 → 5.12.5 accounts for the 2 remaining highs inconsumer-prices-core(fastify,find-my-way). Major, and fastify 5 changes the plugin and typing surface — a migration, not a bump.consumer-prices-corenpm run buildfails, onCannot find module '../../snapshots/orion.js'. That file is simply not in the repository (src/snapshots/contains onlyworldmonitor.ts) and nothing inpackage.jsongenerates it. Pre-existing and unrelated — this PR changes onlypackage.jsonandpackage-lock.json. Worth fixing separately, since it means that sub-workspace cannot currently be built from a clean checkout.