fix(deps): resolve Dependabot HIGH/MODERATE vulnerability alerts - #395
Draft
mtsolakiszen wants to merge 1 commit into
Draft
fix(deps): resolve Dependabot HIGH/MODERATE vulnerability alerts#395mtsolakiszen wants to merge 1 commit into
mtsolakiszen wants to merge 1 commit into
Conversation
Bumps adm-zip to 0.5.18 (CVE-2026-39244, zcli-apps/zcli-connectors) and removes the uuid dependency in zcli-apps in favor of Node's built-in crypto.randomUUID(), which sidesteps CVE-2026-41907 entirely (the CVE affects v3/v5/v6, not v4, but the fixed release is ESM-only and would break this project's CommonJS build). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves the zcli-relevant Dependabot alerts:
adm-zip, HIGH, Warning: themes:preview is not a zcli command #177/Recommended Version of Yarn? #178) — bumpedadm-zip0.5.10 → 0.5.18 inzcli-appsandzcli-connectors. Patch-line fix for a DoS via crafted ZIP uncompressed-size header; no breaking API changes between these versions.uuid, MODERATE, zcli apps:update still broken #160) — removed theuuid/@types/uuiddependency fromzcli-appsand replaceduuidV4()with Node's built-incrypto.randomUUID(). The CVE affectsv3/v5/v6buffer bounds checks, notv4(the only function this codebase used), but the fixed release (uuid@14) is ESM-only and would break this project's CommonJS build, so removing the dependency entirely was the simpler and lower-risk fix.crypto.randomUUID()requires Node ≥14.17, well below this project's declaredengines.node: >=20.17.0.The other alerts in the original batch (
v2_repl_app,marketplace_payment_service) do not apply — those packages aren't present in this repo's dependency tree.Detail
packages/zcli-apps/src/utils/uuid.ts: swappeduuid.v4()forcrypto.randomUUID().packages/zcli-apps/package.json,packages/zcli-connectors/package.json,yarn.lock: dependency bumps/removals.yarn test(268 passing) andtsctype-check onzcli-apps, both on Node v20.20.2 per.nvmrc.Checklist