fix(deps): clear 12 medium-severity Dependabot alerts (hono, ip-address, astro, postcss)#172
Merged
Merged
Conversation
…ss, astro, postcss) Closes 12 medium-severity Dependabot alerts: - #6: astro <6.1.6 — XSS in define:vars via incomplete </script> sanitization - #7: postcss <8.5.10 — XSS via unescaped </style> in CSS Stringify output - #8, #17: ip-address <=10.1.0 — XSS in Address6 HTML-emitting methods - #9, #10, #18, #19: hono <4.12.16 — bodyLimit() bypass + JSX tag injection - #12, #14, #22, #24: hono <4.12.18 — cache Vary header + JSX CSS injection Strategy mirrors PR #170 (the highs): - Root workspace: added `overrides` block (`ip-address >=10.1.1`, `hono >=4.12.18`) + `npm update` to re-resolve. express-rate-limit pins `ip-address: 10.1.0` exactly, so the override is required — `npm update` alone couldn't bump it. - scripts/cdp-bridge (published lockfile, detached from workspace resolver): patched `node_modules/hono` and `node_modules/ip-address` entries directly with new tarball + sha512 integrity, mirroring the fast-uri approach. Added matching overrides to cdp-bridge/package.json so a fresh `npm install rn-dev-agent-cdp` from the published tarball doesn't regress. - docs-site: `npm update astro postcss` was sufficient (astro is a direct dep with `^6.0.1` range that satisfies the patched 6.1.6+; postcss is a transitive via vite with a permissive range). Bumped: astro 6.1.5 → 6.3.3, postcss 8.5.9 → 8.5.14. Real-world exploit surface for the hono advisories is essentially zero in our usage — we use hono only as an MCP-transport transitive of `@modelcontextprotocol/sdk` and never invoke `c.cache()`, `bodyLimit()`, or `hono/jsx`. The bumps are about clearing the dashboard, not patching an active vulnerability. Verified: - cdp-bridge unit suite: 1464/1464 passing - docs-site `npm run build`: 159 pages built in 5.29s, 0 errors Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes all 12 open medium-severity Dependabot alerts on
main. Follow-up to #170 (the highs).astrodocs-site/package-lock.jsondefine:varspostcssdocs-site/package-lock.jsonip-addressAddress6HTML methodshonobodyLimit()bypass + JSX tag injectionhonoVaryheader + JSX CSS injectionHow
Mirrors the strategy from #170, with one new wrinkle:
express-rate-limitpinsip-addressto exactly10.1.0(not a range), sonpm updatealone can't bump it. Required anoverridesentry.Root workspace (
package.json+ root lockfile)Added a new
overridesblock:Then
npm update ip-address hono --package-lock-onlyre-resolved against the override. Result:ip-address 10.2.0,hono 4.12.19in root lockfile.Published
scripts/cdp-bridge/package-lock.jsonDetached from the workspace resolver (consumers
npm install rn-dev-agent-cdpagainst this exact lockfile), so the same approach as #170's fast-uri:node_modules/honoandnode_modules/ip-addressentries directly (new tarball URL + sha512 integrity).scripts/cdp-bridge/package.jsonso fresh consumer installs can't regress.docs-site`npm update astro postcss --package-lock-only` was sufficient — astro is a direct dep with `^6.0.1` range that satisfies 6.1.6+, and postcss is a transitive via vite with a permissive range.
Real-world exploit surface
Worth saying explicitly: we don't actually invoke any of the vulnerable APIs.
c.cache(),bodyLimit(), or usehono/jsx. We use hono only as an MCP-transport transitive — none of those code paths are exercised.Address6.inspect()HTML output. We never call that — we use ip-address only for IPv4/IPv6 parsing insideexpress-rate-limit.define:varsorpostcss.stringify(). Our docs site is fully static-generated from in-repo Markdown.The bumps are about closing the dashboard, not patching an active exploit path.
Test plan
🤖 Generated with Claude Code