fix(deps): resolve 3 Dependabot alerts by dropping vestigial phantomjs deps#1361
Merged
Conversation
…s deps The karma test suite runs on Firefox (tests/js/config/karma.js, gulpfile.js); `karma-phantomjs-launcher` and `phantomjs-prebuilt` were unreferenced anywhere except package.json. `phantomjs-prebuilt` was the SOLE path pulling in the vulnerable request -> tough-cookie / uuid chain. Removing both dead dev deps eliminates those transitive packages entirely. Fixed (packages removed from the dependency tree): - request 2.88.2 removed (#58, SSRF, GHSA-p8p7-x288-28g6; deprecated, no fix) - tough-cookie 2.5.0 removed (#64, prototype pollution, needs >= 4.1.3) - uuid 3.4.0 removed (#129, buffer bounds check, needs >= 11.1.1) Verified: `yarn install --frozen-lockfile` clean, `yarn build` (gulp) green. Test suite runs on Firefox inside an ownCloud core checkout (CI: xvfb) and is unaffected — the removed packages play no role in the karma runtime. Not fixable here (no upstream fix / would need a major migration): - angular / angular-sanitize (#43,#46,#59,#60,#61,#73,#84,#85,#90,#91) — AngularJS 1.x is EOL; all first_patched are null. Real remediation is a framework migration off AngularJS. - babel-traverse 6.26.0 (#76, critical) — only @babel/traverse 7.x is patched; needs babel 6 -> 7 toolchain migration. - lodash.template 3.6.2 (#77, high) — pulled by gulp-util/gulp 3.x; no patched line, deprecated. Resolved by the pending gulp 3 -> 5 upgrade (#1349). Signed-off-by: Thomas Müller <[email protected]>
phil-davis
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses all 15 open Dependabot alerts, in three buckets.
✅ Fixed — 3 alerts
The karma suite runs on Firefox (
tests/js/config/karma.js,gulpfile.js).karma-phantomjs-launcherandphantomjs-prebuiltwere referenced nowhere exceptpackage.json— dead dev deps.phantomjs-prebuiltwas the sole path pulling in the vulnerablerequest → tough-cookie / uuidchain. Removing both eliminates those transitive packages from the tree entirely.These have no in-tree remediation and are not dismissed:
angular(Removes appframework dependancy from 3rdparty. #43, Access dav app via caldav in js #46, update fullcalendar #59, added more and optional colors to color picker #60, update ical.js #61, Make calendar app a CalDAV client #73, Only build master branch on push on travis #84, List view #85, Fixes buttons fuck up and grunt issues. #90) andangular-sanitize(Timezone service #91). Allfirst_patchedare null; AngularJS 1.x is EOL. Real remediation: migrate off AngularJS. These are direct runtime deps and out of scope for a dependency bump.@babel/traverse7.x is patched; requires a babel 6→7 toolchain migration.gulp-util/gulp3.x; deprecated, no patched line. Resolved by the pending gulp 3→5 upgrade (Bump gulp from 3.9.1 to 5.0.1 #1349).Test plan
yarn install --frozen-lockfile— clean (lockfile consistent).yarn build(gulp: jslint + build + minify) — ✅ green.enable-xvfb-display-server). The removed packages are a defunct test-launcher with no role in the karma runtime, so the suite is unaffected. (Locally, Firefox isn't installed; a ChromeHeadless spot-run confirmed the karma config loads and the dep removal introduces no new failures — remaining local failures are the expected missing-core-vendor/momentenvironment, unrelated to this change.)