chore(deps): resolve Dependabot critical/high/moderate alerts#394
Merged
Conversation
Direct bumps: - vitest + @vitest/coverage-v8: ^3.2.4 → ^4.1.0 (patches GHSA-5xrq-8626-4rwp, critical, arbitrary file read/exec via Vitest UI server). Override migration: package.json#pnpm.overrides → pnpm-workspace.yaml#overrides. pnpm v11 silently ignores the package.json variant — every existing override (valtio, vite, midnight-js-*, etc.) was inert until this migration. Verified by inspecting the lockfile: valtio resolved to 1.11.2 pre-PR despite override saying ^1.13.2; now correctly resolves to 1.13.2. New security overrides: - axios <1.16.0 → ^1.16.0 (15 advisories: prototype pollution, SSRF, header/CRLF injection, ReDoS, etc.) - hono <4.12.21 → ^4.12.21 (15 advisories: cookie injection, JWT issues, cache-leakage, path traversal, etc.) - protobufjs <7.5.8 → ^7.5.8 (8 advisories: DoS, RCE, prototype pollution) - @protobufjs/utf8 <1.1.1 → ^1.1.1 (overlong UTF-8 decoding) - tmp <0.2.6 → ^0.2.6 (path traversal via symlink) - lodash <4.18.0 → ^4.18.0 (code injection, prototype pollution) - minimatch <3.1.3 / ^9 <9.0.7 → patched (ReDoS) - fast-uri <=3.1.1 → ^3.1.2 (host confusion, path traversal) - @metamask/sdk + @metamask/sdk-communication-layer <0.33.1 → ^0.33.1 (malicious [email protected] transitive) - ip-address <=10.1.0 → ^10.1.1 (XSS in Address6 HTML) - picomatch >=4 <4.0.4 → ^4.0.4 (method injection) - follow-redirects <=1.15.11 → ^1.16.0 (auth header leakage) - postcss <8.5.10 → ^8.5.10 (XSS via unescaped </style>) vitest 4 compatibility fixes: - vitest.config.ts: remove deprecated test.poolOptions (rolled into top-level pool options); add server.fs.allow for sibling openzeppelin-adapters checkout so patch-file imports in export tests don't trip vite's fs.deny. - 5 test files: convert vi.fn(arrow) / vi.fn().mockImplementation(arrow) mocks used as constructors into regular function expressions, since vitest 4 / tinyspy 4 now use Reflect.construct(impl, args) which throws on arrow functions per ES spec. - generateAndAddAppConfig.test.ts: clear the spy before counting calls (previous tests accumulated state since vi.spyOn no longer replaces an existing vi.fn cleanly in vitest 4). Not fixed in this PR (justifications for dismissal in Security tab): - uuid <11.1.1 (GHSA-w5hq) — CVE only affects v3/v5/v6(buf); our chain uses v4(). Forcing ^11 breaks @solana/web3.js peer constraints. - elliptic 6.6.1 (GHSA-848j) — no upstream patch exists. - bigint-buffer 1.1.5 (GHSA-3gc7) — no upstream patch; transitive via @solana/spl-token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single-PR sweep of open Dependabot advisories on ui-builder. Knocks out 4 criticals, most highs, and most moderates by bumping direct deps and migrating + adding workspace pnpm overrides.
Direct dep bump
vitest+@vitest/coverage-v8^3.2.4→^4.1.0in root +apps/builder— patches GHSA-5xrq-8626-4rwp (arbitrary file read/exec via Vitest UI server). Resolves to4.1.8.Override migration:
package.json#pnpm→pnpm-workspace.yamlpnpm v11 silently ignores
package.json#pnpm.overrides. The existing overrides (valtio,vite, midnight-js-*, etc.) were already inert. Verified: pre-PRvaltioresolved to1.11.2despite override declaring^1.13.2; post-PR correctly resolves to1.13.2.vitewas stuck at both7.3.1and7.3.2— now only7.3.2.minimumReleaseAgeandpatchedDependenciesmigrated the same way;vitest/@vitest/*added tominimumReleaseAgeExcludesince some metadata is missing thetimefield.New security overrides
axios<1.16.0→^1.16.0hono<4.12.21→^4.12.21protobufjs<7.5.8→^7.5.8@protobufjs/utf8<1.1.1→^1.1.1tmp<0.2.6→^0.2.6lodash<4.18.0→^4.18.0minimatch<3.1.3and^9 <9.0.7→ patchedfast-uri<=3.1.1→^3.1.2@metamask/sdk+…-communication-layer<0.33.1→^0.33.1ip-address<=10.1.0→^10.1.1picomatch>=4 <4.0.4→^4.0.4follow-redirects<=1.15.11→^1.16.0postcss<8.5.10→^8.5.10Vitest 4 compatibility fixes
Config (
apps/builder/vitest.config.ts)test.poolOptions(rolled into top-level pool options in v4).server.fs.allowfor the siblingopenzeppelin-adapterscheckout so adapter patch-file imports in export tests don't trip vite'sfs.deny.Test mocks (5 files) — vitest 4 / tinyspy 4 use
Reflect.construct(impl, args)fornew, which throws on arrow-function impls per ES spec. Converted:apps/builder/src/export/__tests__/PackageManager.test.tsapps/builder/src/export/__tests__/VersioningSafetyGuard.test.tsapps/builder/src/export/assemblers/__tests__/copyAdapterPatchFiles.test.tsapps/builder/src/export/generators/__tests__/AppCodeGenerator.test.tsapps/builder/src/export/assemblers/__tests__/generateAndAddAppConfig.test.ts(vi.spyOnover an existingvi.fn()no longer auto-clears prior calls — added explicitmockClear()before counting).Not fixed in this PR (justifications for dismissal)
uuid8.x/9.x — GHSA-w5hq-g745-h8pqv3/v5/v6(buf). Solana web3.js / MetaMask utils callv4()only. Forcing^11breaks@solana/web3.jspeer constraints.elliptic6.6.1 — GHSA-848j-6mx2-7j84bigint-buffer1.1.5 — GHSA-3gc7-fjrx-p6mg@solana/spl-token.Test plan
pnpm installsucceeds; lockfile regenerated cleanlypnpm -r typecheckpassespnpm test— all 311 tests pass (apps/builder 306, scripts 5) on vitest 4.1.8pnpm-lock.yaml:7.3.1→ only7.3.21.13.6/1.14.0→ only1.16.14.12.12→4.12.237.4.0→7.6.00.0.33→0.2.74.17.21→4.18.13.1.0→3.1.24.0.3→4.0.41.15.11→1.16.08.5.8→8.5.1510.1.0→10.2.00.32.0→0.33.1only1.11.2→1.13.2(proves the workspace migration is effective)