From ba0ce009633ef5849dd9fc5a9170e3b96ecaba40 Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Mon, 22 Jun 2026 06:49:34 +0200 Subject: [PATCH] fix(deps): override undici to ^6.27.0 to patch 4 transitive advisories discord.js@14.26.4 (latest) still pins undici@6.24.1, which is in the vulnerable range (<=6.26.0): high-sev Set-Cookie header injection plus 3 moderate (WebSocket DoS, response-queue poisoning, SameSite downgrade). An npm overrides entry forces the patched 6.27.0 within the same major, so it stays API-compatible with @discordjs/rest/@discordjs/ws. npm audit now reports 0 vulnerabilities; no discord.js downgrade needed. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 5 +++++ package-lock.json | 6 +++--- package.json | 3 +++ 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 567c063..75bfaef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ All notable changes to the **MSK Giveaway Bot**. Format based on [Keep a Changelog](https://keepachangelog.com). +## [Unreleased] + +### Security / hardening +- Pinned a patched **`undici` (`^6.27.0`)** via an npm `overrides` entry, resolving 4 transitive advisories (1 high / 3 moderate) pulled in through `discord.js` → `@discordjs/rest`/`@discordjs/ws` (HTTP header injection via `Set-Cookie`, WebSocket DoS, response-queue poisoning, `SameSite` downgrade). discord.js itself is already on the latest 14.x but still pins the vulnerable `undici@6.24.1`; the override stays inside the same 6.x major, so it is API-compatible. `npm audit` now reports **0 vulnerabilities** — no discord.js downgrade required. + ## [1.4.0] ### Added diff --git a/package-lock.json b/package-lock.json index cb7d18f..5dd690a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -427,9 +427,9 @@ "license": "0BSD" }, "node_modules/undici": { - "version": "6.24.1", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz", - "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==", + "version": "6.27.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", + "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", "license": "MIT", "engines": { "node": ">=18.17" diff --git a/package.json b/package.json index 638c75a..107f6a6 100644 --- a/package.json +++ b/package.json @@ -27,5 +27,8 @@ }, "devDependencies": { "prisma": "^5.20.0" + }, + "overrides": { + "undici": "^6.27.0" } }