effect@3.17.7 sits in the production dependency tree via uploadthing@7.7.4 and carries an open high advisory (GHSA-38f7-945m-qr2g): AsyncLocalStorage context can be lost or contaminated across Effect fibers under concurrent load. In a Worker that's a cross-request context-bleed class of bug, so it's worth moving even though nothing in our code triggers it directly.
The fix needs effect >= 3.20.0, and uploadthing 7.7.4 pins below that, so this means moving uploadthing itself — its own change with its own testing of the upload flow, which is why it didn't fold into the dependency-overrides PR (deps/security-overrides branch in sona-fast/sona). That PR's lockfile guard (check:lockfile-security) covers cookie, esbuild, nanoid, and undici only; this advisory is the one remaining production-runtime high in npm audit.
Done means: uploadthing bumped to a release that resolves effect at or above 3.20.0, upload flow verified, and npm audit shows no high advisories on the production tree.
effect@3.17.7sits in the production dependency tree viauploadthing@7.7.4and carries an open high advisory (GHSA-38f7-945m-qr2g): AsyncLocalStorage context can be lost or contaminated across Effect fibers under concurrent load. In a Worker that's a cross-request context-bleed class of bug, so it's worth moving even though nothing in our code triggers it directly.The fix needs
effect >= 3.20.0, and uploadthing 7.7.4 pins below that, so this means moving uploadthing itself — its own change with its own testing of the upload flow, which is why it didn't fold into the dependency-overrides PR (deps/security-overridesbranch in sona-fast/sona). That PR's lockfile guard (check:lockfile-security) covers cookie, esbuild, nanoid, and undici only; this advisory is the one remaining production-runtime high innpm audit.Done means: uploadthing bumped to a release that resolves effect at or above 3.20.0, upload flow verified, and
npm auditshows no high advisories on the production tree.