fix(deps): close 5 high-severity Dependabot alerts (fast-uri + devalue)#170
Merged
Conversation
…bot HIGHs Closes 5 high-severity Dependabot alerts: - #11, #15: fast-uri path traversal (scripts/cdp-bridge/package-lock.json) - #20, #21: fast-uri host confusion (root package-lock.json) - #25: devalue DoS via sparse array deserialization (docs-site/package-lock.json) fast-uri reaches us transitively via @modelcontextprotocol/sdk → ajv@8.18.0, which accepts ^3.0.1 — patched 3.1.2 already in range, just needed lockfile re-resolution. Added a defensive `>=3.1.2` override in scripts/cdp-bridge/ package.json so a fresh install on the published tarball can't regress. devalue 5.7.1 → 5.8.1 is the same shape via astro@6.1.5 (^5.x range satisfies). Verified: cdp-bridge unit suite passes (1464/1464). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Merged
4 tasks
Lykhoyda
added a commit
that referenced
this pull request
May 18, 2026
…ss, astro, postcss) (#172) Closes 12 medium-severity Dependabot alerts: - #6: astro <6.1.6 — XSS in define:vars via incomplete </script> sanitization - #7: postcss <8.5.10 — XSS via unescaped </style> in CSS Stringify output - #8, #17: ip-address <=10.1.0 — XSS in Address6 HTML-emitting methods - #9, #10, #18, #19: hono <4.12.16 — bodyLimit() bypass + JSX tag injection - #12, #14, #22, #24: hono <4.12.18 — cache Vary header + JSX CSS injection Strategy mirrors PR #170 (the highs): - Root workspace: added `overrides` block (`ip-address >=10.1.1`, `hono >=4.12.18`) + `npm update` to re-resolve. express-rate-limit pins `ip-address: 10.1.0` exactly, so the override is required — `npm update` alone couldn't bump it. - scripts/cdp-bridge (published lockfile, detached from workspace resolver): patched `node_modules/hono` and `node_modules/ip-address` entries directly with new tarball + sha512 integrity, mirroring the fast-uri approach. Added matching overrides to cdp-bridge/package.json so a fresh `npm install rn-dev-agent-cdp` from the published tarball doesn't regress. - docs-site: `npm update astro postcss` was sufficient (astro is a direct dep with `^6.0.1` range that satisfies the patched 6.1.6+; postcss is a transitive via vite with a permissive range). Bumped: astro 6.1.5 → 6.3.3, postcss 8.5.9 → 8.5.14. Real-world exploit surface for the hono advisories is essentially zero in our usage — we use hono only as an MCP-transport transitive of `@modelcontextprotocol/sdk` and never invoke `c.cache()`, `bodyLimit()`, or `hono/jsx`. The bumps are about clearing the dashboard, not patching an active vulnerability. Verified: - cdp-bridge unit suite: 1464/1464 passing - docs-site `npm run build`: 159 pages built in 5.29s, 0 errors Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes all 5 open high-severity Dependabot alerts on
main:fast-uriscripts/cdp-bridge/package-lock.jsonfast-uriscripts/cdp-bridge/package-lock.jsonfast-uripackage-lock.jsonfast-uripackage-lock.jsondevaluedocs-site/package-lock.jsonHow
Both packages reach us transitively — patches sit inside the parent's existing semver range, so no
package.jsonAPI change is required.fast-uri: pulled in via@modelcontextprotocol/sdk → ajv@8.18.0(^3.0.1). 3.1.2 already satisfies that range.npm update fast-uri --package-lock-only.scripts/cdp-bridge/package-lock.jsonis a published lockfile (shipped to npm consumers); it can't be re-resolved through the workspace root, so I patched itsnode_modules/fast-urientry directly (version + resolved + integrity sha512). I also added a defensive"fast-uri": ">=3.1.2"override inscripts/cdp-bridge/package.jsonso a freshnpm install rn-dev-agent-cdpon a future ajv release that pins an older fast-uri can't regress.devalue: pulled in viaastro@6.1.5.npm update devalue --package-lock-onlyindocs-site/handled it cleanly.Test plan
npm installin cdp-bridge clean, no integrity errors)main🤖 Generated with Claude Code