fix(appsec): bump @datadog/wasm-js-rewriter to 5.0.2 to resolve js-yaml vulnerability (GHSA-5p4m-2wfm-xmqj) - #9768
Conversation
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e9f84221f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| integrity sha512-ffv9TqdtuE8XnZgaGnmMIU1A+t+eaHIEbdVpV5elijq1dKK03OqFb+Xo4ojTbgCwxIYDA1zmA8TnZJBjtzuVuw== | ||
| dependencies: | ||
| js-yaml "^4.1.0" | ||
| js-yaml "^4.1.1" |
There was a problem hiding this comment.
This still depends on js-yaml through ^4.1.1, and the checked-in lockfile continues to resolve the combined js-yaml@^4.1.0, js-yaml@^4.1.1 entry to 4.1.1. GHSA-5p4m-2wfm-xmqj marks >=4.0.0 <4.3.1 as affected and 4.3.1 as patched, so repo installs and lockfile-based consumers remain vulnerable even after this bump; please use a rewriter release/override that requires js-yaml >=4.3.1 <5 and update the lockfile accordingly.
Useful? React with 👍 / 👎.
…GHSA-5p4m-2wfm-xmqj) @datadog/wasm-js-rewriter@5.0.2 only loosened its own js-yaml range to ^4.1.1, which still permits resolving the vulnerable 4.1.x-4.3.0 range. Add a yarn resolution scoped to that dependency edge so it resolves to the patched 4.3.1 instead.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14dfe5265a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| integrity sha512-ffv9TqdtuE8XnZgaGnmMIU1A+t+eaHIEbdVpV5elijq1dKK03OqFb+Xo4ojTbgCwxIYDA1zmA8TnZJBjtzuVuw== | ||
| dependencies: | ||
| js-yaml "^4.1.0" | ||
| js-yaml "^4.1.1" |
There was a problem hiding this comment.
Fresh evidence after the added resolution: this new 5.0.2 lock entry still advertises js-yaml "^4.1.1", which can satisfy 4.1.1 or 4.3.0 even though GHSA-5p4m-2wfm-xmqj lists >=4.0.0 <4.3.1 as affected. For downstream npm installs of the published dd-trace package, the repo-level resolutions entry is not applied—npm documents that overrides are “only considered in the root package.json” and published packages should pin dependencies or use shrinkwrap—so existing consumer lockfiles can keep a vulnerable js-yaml; please publish/use a rewriter whose own dependency range excludes <4.3.1.
Useful? React with 👍 / 👎.
|
Good catch — you're right that the yarn `resolutions` entry only affects this repo's own installs/lockfile and doesn't propagate to downstream `npm install dd-trace` consumers, since npm/yarn only honor `overrides`/`resolutions` declared in the root project, not inside a dependency's own tree. No newer `@datadog/wasm-js-rewriter` release exists yet with a tightened `js-yaml` range, so I opened the real fix upstream: DataDog/dd-wasm-js-rewriter#198, which bumps its declared `js-yaml` range to `^4.3.1` and cuts `5.0.3`. This PR is blocked on that one merging and being published to npm. Once `5.0.3` is available, I'll update this PR to depend on it directly and drop the `resolutions` workaround (keeping it until then as defense-in-depth for this repo's own installs). |
|
v5.0.3 has been released, feel free to update your PR |
2 participants
Summary
@datadog/wasm-js-rewriterfrom5.0.1to5.0.25.0.2tightens its ownjs-yamldependency range from^4.1.0to^4.1.1, resolving the transitive vulnerability reported injs-yaml@4.3.0(GHSA-5p4m-2wfm-xmqj, CVSS 7.5), affectingdd-tracev5.114.0–v5.121.0 and v6.10.0.Test plan
yarn installrun locally against the updatedpackage.json; lockfile regenerated identically to the hand-edited version (no unrelated drift)node_modules/@datadog/wasm-js-rewriter/package.jsonresolves to5.0.2node_modules/js-yaml/package.jsonversion is no longer the vulnerable4.3.0Reported by a customer via support; requests a release on both the v5 maintenance and v6 current lines once merged.