Repository navigation
chore(deps): clear the fixable high and critical advisories within current majors - #1049
Conversation
…840) Same-major bumps only, no code changes: - axios ^1.7.4 -> ^1.20.0 (1.11.0 -> 1.20.0): fixes the high-severity advisories published against 1.11.0 (fixed in 1.12.0 .. 1.16.0). - @modelcontextprotocol/sdk ^1.13.3 -> ^1.32.1 (1.17.1 -> 1.32.1): fixes the high-severity advisories fixed in 1.24.0 .. 1.31.0. Stays on the 1.x line the MCP server already targets. - node-forge ^1.3.3 -> ^1.4.0: fixes the high-severity advisories fixed in 1.4.0. - lodash ^4.17.21 -> ^4.18.1: fixes the high-severity advisory fixed in 4.18.0. - typeorm ^0.3.17 -> ^0.3.31 (0.3.25 -> 0.3.31): fixes the advisory fixed in 0.3.26; patch releases within 0.3.x. Ranges are raised to the resolved versions so a fresh resolve cannot fall back below the fixed release. bun.lock is refreshed accordingly.
…DEM-840) Lockfile-only refresh (bun update <pkg>, package.json untouched) of transitive packages that had known high-severity advisories. Every bump stays inside the range requested by its dependent, so no behaviour change is expected: - ws 8.18.2 -> 8.22.0 - engine.io 6.6.4 -> 6.6.11 - socket.io-parser 4.2.6 -> 4.2.7 - proxy-addr 2.0.7 -> 2.0.8 (critical) - form-data 4.0.4 -> 4.0.6 (nested 3.0.4 -> 3.0.5, 4.0.4 -> 4.0.6) - fast-uri 2.4.0 -> 2.4.7, 3.0.6 -> 3.1.8 - minimatch 3.1.2 -> 3.1.5, 5.1.6 -> 5.1.9, 9.0.5 -> 9.0.9 - brace-expansion 1.1.12 -> 1.1.21, 2.0.2 -> 2.1.7 - picomatch 4.0.3 -> 4.0.7, 2.3.1 -> 2.3.2 - tar-fs 2.1.3 -> 2.1.5 - tmp 0.2.4 -> 0.2.7 - underscore 1.12.1 -> 1.13.6 - jsonpath 1.1.1 -> 1.3.0 (pulls static-eval 2.1.1, esprima 1.2.5 and escodegen 2.1.0; it is only reached through snarkjs/bfj) - path-to-regexp (router) 8.2.0 -> 8.4.2
…3 (DEM-840) express 4.21.2 pins path-to-regexp to exactly 0.1.12, which carries a high-severity ReDoS advisory fixed in 0.1.13; the pin can only be lifted by taking a newer express 4.x release. Same major, no API changes. Behaviour notes from the 4.22.x history: qs moves 6.13 -> 6.16 and body-parser 1.20.3 -> 1.20.8; req.query now parses repeated keys and indexed arrays up to 1000 items (previously capped at 20 for indexed notation); req.fresh also applies to QUERY requests.
… (DEM-840) Both packages are held back by exact pins in dependents, so a lockfile refresh alone cannot move them. Overrides follow the existing pattern in package.json. - @openzeppelin/contracts 3.4.1-solc-0.7-2 -> 3.4.2-solc-0.7: the 3.4.x patch release for the solc 0.7 line, already installed under @uniswap/v3-periphery, so the tree now has a single copy. Only the Solidity sources change and only the optional rubic-sdk chain pulls them in. Trivy still lists it because it orders the "-solc-0.7" pre-release tag below 3.4.2; the real fix for a 3.x consumer is this tag. - underscore 1.13.6 -> 1.13.8: jsonpath 1.3.0 pins 1.13.6 exactly; patch release within 1.13.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
1 participant
Reduces the known-vulnerability backlog on
stabilisationwithout major-version upgrades. Trivy onbun.lock, before → after: critical 3 → 2, high 73 → 21, medium 60 → 21, low 8 → 5.What moves
package.json): axios ^1.20.0, @modelcontextprotocol/sdk ^1.32.1, node-forge ^1.4.0, lodash ^4.18.1, typeorm ^0.3.31, express ^4.22.3 (needed to lift path-to-regexp to 0.1.13).uniq).Rollout note
node-forge 1.4.0 makes
ed25519.verifyreject a signature whose S scalar is not canonical (S ≥ L), which 1.3.3 accepted. Honest signers always produce canonical S, so only malleated signatures are affected, but a 1.3.3 node and a 1.4.0 node would disagree on such a signature. Roll validators together.Verified
bun install --frozen-lockfile,bun run type-check.src/features/mcp, and its SSE mode was already broken on the old SDK (doublewriteHead), tracked separately.Still open after this
fastify 4 → 5 (with @fastify/swagger-ui), tar 6 → 7 (dev tooling only), toml 3 → 4 (via the anchor packages inside demosdk), and bigint-buffer, http-cache-semantics and one node-forge advisory with no fix released.