Skip to content

[Snyk] Fix for 3 vulnerabilities #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@
"@midwayjs/validate": "3",
"@typegoose/typegoose": "^11.7.1",
"dotenv": "^16.3.1",
"glob": "^10.3.10",
"glob": "^12.0.0",

@devin-ai-integration devin-ai-integration Bot Apr 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 glob v12 requires Node >=20 but project builds and runs on Node 18

Upgrading glob from ^10.3.10 to ^12.0.0 introduces a Node.js version incompatibility. glob@12.0.0 declares engines: { node: '20 || >=22' }, but the project's Dockerfile (Dockerfile:1 and Dockerfile:14) uses node:18-alpine for both build and runtime stages, and package.json:50 declares "node": ">=18.0.0". glob v12 uses Node 20+ features internally, so import { glob } from 'glob' at src/utils/register-model.ts:4 will likely fail at runtime on Node 18 with syntax or API errors, breaking model registration and application startup.

Prompt for agents 
The glob package was bumped from ^10.3.10 to ^12.0.0, but glob v12 requires Node.js 20 or >=22. The project currently targets Node 18 (see Dockerfile lines 1 and 14 using node:18-alpine, and package.json engines field specifying >=18.0.0). There are two possible fixes:

1. Revert glob to a version compatible with Node 18 (e.g. keep ^10.3.10, or use ^11.x which also supports Node 18).
2. Upgrade the Node.js version across the project: update the Dockerfile FROM lines to node:20-alpine (or higher), and update the engines field in package.json to >=20.0.0.

The glob import is used in src/utils/register-model.ts:4 and called at line 12.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@cursor cursor Bot Apr 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Glob v12 incompatible with project's Node.js 18 minimum

High Severity

Upgrading glob from ^10.3.10 to ^12.0.0 introduces a Node.js version incompatibility. glob v11+ requires Node.js 20 or higher, but the project's engines field declares "node": ">=18.0.0". This means the application will fail at install time or runtime for anyone using Node.js 18.x, which the project explicitly supports.

Additional Locations (1)
Fix in Cursor Fix in Web

"lint-staged": "^15.2.2",
"lodash": "^4.17.21",
"lodash": "^4.18.1",
"mongoose": "^7.0.0",
"mongoose-delete": "^1.0.1",
"read-pkg": "5",
Expand Down
218 changes: 167 additions & 51 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Manual changes might be lost - proceed with caution!

__metadata:
version: 8
version: 6

@cursor cursor Bot Apr 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yarn.lock metadata version downgraded from 8 to 6

Medium Severity

The yarn.lock metadata version was changed from 8 to 6. Version 8 is the lockfile format for Yarn 4 (the project uses "packageManager": "yarn@4.0.2"), while version 6 corresponds to Yarn 3. This indicates the Snyk bot regenerated the lockfile with an incompatible Yarn version, which can cause cache mismatches, resolution inconsistencies, or unexpected behavior with Yarn 4.

Fix in Cursor Fix in Web

cacheKey: 10c0

"@aashutoshrathi/word-wrap@npm:^1.2.3":
Expand Down Expand Up @@ -1103,6 +1103,13 @@ __metadata:
languageName: node
linkType: hard

"@isaacs/cliui@npm:^9.0.0":
version: 9.0.0
resolution: "@isaacs/cliui@npm:9.0.0"
checksum: 8/9b80836cd9fa64099faffc3cb9c0620fd8c1106670f507378c5030daecfe9a29012a67488299e69f3273c6421da2a27ea6a1f1d7600bac01b0cbb5da8eea6277
languageName: node
linkType: hard

"@istanbuljs/load-nyc-config@npm:^1.0.0":
version: 1.1.0
resolution: "@istanbuljs/load-nyc-config@npm:1.1.0"
Expand Down Expand Up @@ -1871,45 +1878,45 @@ __metadata:
version: 0.0.0-use.local
resolution: "@onekeybe/boilerplate@workspace:."
dependencies:
"@aws-sdk/client-cloudwatch-logs": "npm:^3.454.0"
"@aws-sdk/client-secrets-manager": "npm:^3.454.0"
"@faker-js/faker": "npm:^8.3.1"
"@midwayjs/bootstrap": "npm:^3.12.5"
"@midwayjs/bull": "npm:3"
"@midwayjs/cli": "npm:^2.1.1"
"@midwayjs/core": "npm:^3.13.0"
"@midwayjs/cross-domain": "npm:^3.12.10"
"@midwayjs/decorator": "npm:^3.12.3"
"@midwayjs/i18n": "npm:3.13.7"
"@midwayjs/koa": "npm:^3.12.0"
"@midwayjs/logger": "npm:^2.19.3"
"@midwayjs/mock": "npm:^3.12.10"
"@midwayjs/mongoose": "npm:3"
"@midwayjs/redis": "npm:3"
"@midwayjs/validate": "npm:3"
"@typegoose/typegoose": "npm:^11.7.1"
"@types/jest": "npm:^29.5.9"
"@types/koa": "npm:^2.13.12"
"@types/lodash": "npm:^4.14.202"
"@types/mongoose-delete": "npm:^1.0.3"
"@types/node": "npm:14"
cross-env: "npm:^7.0.3"
dotenv: "npm:^16.3.1"
eslint-plugin-import: "npm:^2.29.0"
glob: "npm:^10.3.10"
husky: "npm:^9.0.11"
jest: "npm:^29.7.0"
lint-staged: "npm:^15.2.2"
lodash: "npm:^4.17.21"
lokalise-client: "npm:^1.1.9"
mongoose: "npm:^7.0.0"
mongoose-delete: "npm:^1.0.1"
mwts: "npm:^1.3.0"
read-pkg: "npm:5"
rimraf: "npm:^5.0.5"
ts-jest: "npm:^29.1.1"
typescript: "npm:~5.3.2"
winston-cloudwatch: "npm:^6.2.0"
"@aws-sdk/client-cloudwatch-logs": ^3.454.0
"@aws-sdk/client-secrets-manager": ^3.454.0
"@faker-js/faker": ^8.3.1
"@midwayjs/bootstrap": ^3.12.5
"@midwayjs/bull": 3
"@midwayjs/cli": ^2.1.1
"@midwayjs/core": ^3.13.0
"@midwayjs/cross-domain": ^3.12.10
"@midwayjs/decorator": ^3.12.3
"@midwayjs/i18n": 3.13.7
"@midwayjs/koa": ^3.12.0
"@midwayjs/logger": ^2.19.3
"@midwayjs/mock": ^3.12.10
"@midwayjs/mongoose": 3
"@midwayjs/redis": 3
"@midwayjs/validate": 3
"@typegoose/typegoose": ^11.7.1
"@types/jest": ^29.5.9
"@types/koa": ^2.13.12
"@types/lodash": ^4.14.202
"@types/mongoose-delete": ^1.0.3
"@types/node": 14
cross-env: ^7.0.3
dotenv: ^16.3.1
eslint-plugin-import: ^2.29.0
glob: ^12.0.0
husky: ^9.0.11
jest: ^29.7.0
lint-staged: ^15.2.2
lodash: ^4.18.1
lokalise-client: ^1.1.9
mongoose: ^7.0.0
mongoose-delete: ^1.0.1
mwts: ^1.3.0
read-pkg: 5
rimraf: ^5.0.5
ts-jest: ^29.1.1
typescript: ~5.3.2
winston-cloudwatch: ^6.2.0
languageName: unknown
linkType: soft

Expand Down Expand Up @@ -3490,6 +3497,13 @@ __metadata:
languageName: node
linkType: hard

"balanced-match@npm:^4.0.2":
version: 4.0.4
resolution: "balanced-match@npm:4.0.4"
checksum: 8/fb07bb66a0959c2843fc055838047e2a95ccebb837c519614afb067ebfdf2fa967ca8d712c35ced07f2cd26fc6f07964230b094891315ad74f11eba3d53178a0
languageName: node
linkType: hard

"base64-js@npm:^1.3.1":
version: 1.5.1
resolution: "base64-js@npm:1.5.1"
Expand Down Expand Up @@ -3556,6 +3570,15 @@ __metadata:
languageName: node
linkType: hard

"brace-expansion@npm:^5.0.5":
version: 5.0.5
resolution: "brace-expansion@npm:5.0.5"
dependencies:
balanced-match: ^4.0.2
checksum: 8/4481b7ffa467b34c14e258167dbd8d9485a2d31d03060e8e8b38142dcde32cdc89c8f55b04d3ae7aae9304fa7eac1dfafd602787cf09c019cc45de3bb6950ffc
languageName: node
linkType: hard

"braces@npm:^3.0.2, braces@npm:~3.0.2":
version: 3.0.2
resolution: "braces@npm:3.0.2"
Expand Down Expand Up @@ -4249,6 +4272,17 @@ __metadata:
languageName: node
linkType: hard

"cross-spawn@npm:^7.0.6":
version: 7.0.6
resolution: "cross-spawn@npm:7.0.6"
dependencies:
path-key: ^3.1.0
shebang-command: ^2.0.0
which: ^2.0.1
checksum: 8/8d306efacaf6f3f60e0224c287664093fa9185680b2d195852ba9a863f85d02dcc737094c6e512175f8ee0161f9b87c73c6826034c2422e39de7d6569cf4503b
languageName: node
linkType: hard

"crypt@npm:0.0.2":
version: 0.0.2
resolution: "crypt@npm:0.0.2"
Expand Down Expand Up @@ -5399,6 +5433,16 @@ __metadata:
languageName: node
linkType: hard

"foreground-child@npm:^3.3.1":
version: 3.3.1
resolution: "foreground-child@npm:3.3.1"
dependencies:
cross-spawn: ^7.0.6
signal-exit: ^4.0.1
checksum: 8/b2c1a6fc0bf0233d645d9fefdfa999abf37db1b33e5dab172b3cbfb0662b88bfbd2c9e7ab853533d199050ec6b65c03fcf078fc212d26e4990220e98c6930eef
languageName: node
linkType: hard

"form-data@npm:^4.0.0":
version: 4.0.0
resolution: "form-data@npm:4.0.0"
Expand Down Expand Up @@ -5482,9 +5526,9 @@ __metadata:
languageName: node
linkType: hard

"fsevents@patch:fsevents@npm%3A^2.3.2#optional!builtin<compat/fsevents>, fsevents@patch:fsevents@npm%3A~2.3.2#optional!builtin<compat/fsevents>":
"fsevents@patch:fsevents@npm%3A^2.3.2#~builtin<compat/fsevents>, fsevents@patch:fsevents@npm%3A~2.3.2#~builtin<compat/fsevents>":
version: 2.3.3
resolution: "fsevents@patch:fsevents@npm%3A2.3.3#optional!builtin<compat/fsevents>::version=2.3.3&hash=df0bf1"
resolution: "fsevents@patch:fsevents@npm%3A2.3.3#~builtin<compat/fsevents>::version=2.3.3&hash=df0bf1"
dependencies:
node-gyp: "npm:latest"
conditions: os=darwin
Expand Down Expand Up @@ -5647,6 +5691,22 @@ __metadata:
languageName: node
linkType: hard

"glob@npm:^12.0.0":
version: 12.0.0
resolution: "glob@npm:12.0.0"
dependencies:
foreground-child: ^3.3.1
jackspeak: ^4.1.1
minimatch: ^10.1.1
minipass: ^7.1.2
package-json-from-dist: ^1.0.0
path-scurry: ^2.0.0
bin:
glob: dist/esm/bin.mjs
checksum: 8/e40a6d3f57c999f4157bf82330c369e9383ed09a7cd5c36528f496c7fd237131f9b9da6e81779e15e4b18a31f65b13dac62ff324f4fe8029521e1330f6e259dd
languageName: node
linkType: hard

"glob@npm:^7.1.3, glob@npm:^7.1.4":
version: 7.2.3
resolution: "glob@npm:7.2.3"
Expand Down Expand Up @@ -6586,6 +6646,15 @@ __metadata:
languageName: node
linkType: hard

"jackspeak@npm:^4.1.1":
version: 4.2.3
resolution: "jackspeak@npm:4.2.3"
dependencies:
"@isaacs/cliui": ^9.0.0
checksum: 8/256c2a35b781b61a368b29cff30c901163f2726c768920d160a743429ea7ff4a02f254fa5a27ebbf6444c1a544ec45b0f46d5c6a44f6cc23b0bcd2b6b919ccb0
languageName: node
linkType: hard

"jake@npm:^10.8.5":
version: 10.8.7
resolution: "jake@npm:10.8.7"
Expand Down Expand Up @@ -7439,6 +7508,13 @@ __metadata:
languageName: node
linkType: hard

"lodash@npm:^4.18.1":
version: 4.18.1
resolution: "lodash@npm:4.18.1"
checksum: 8/bb5f5b49aad29614e709af02b64c56b0f8b78c6a81434a3c1ae527d2f0f78ca08f9d9fb22aa825a053876c9d2166e9c01f31c356014b5e2bdc0556c057433102
languageName: node
linkType: hard

"log-update@npm:^6.0.0":
version: 6.0.0
resolution: "log-update@npm:6.0.0"
Expand Down Expand Up @@ -7511,6 +7587,13 @@ __metadata:
languageName: node
linkType: hard

"lru-cache@npm:^11.0.0":
version: 11.2.7
resolution: "lru-cache@npm:11.2.7"
checksum: 8/c4aba67de4a8566622eb1e99cc5f43c1f91129c941af7624d4bbd48f312525d4bf4ce808a414d658a6bc336f0163daa1098d3a3e736989ad65d3231f587fbc30
languageName: node
linkType: hard

"lru-cache@npm:^5.1.1":
version: 5.1.1
resolution: "lru-cache@npm:5.1.1"
Expand Down Expand Up @@ -7760,6 +7843,15 @@ __metadata:
languageName: node
linkType: hard

"minimatch@npm:^10.1.1":
version: 10.2.5
resolution: "minimatch@npm:10.2.5"
dependencies:
brace-expansion: ^5.0.5
checksum: 8/000423875fecbc7da1d74bf63c9081363a71291ef2588c376c45647ac004582cb5bc8cc09ef84420b26bfb490f4d0818d328e78569c6228e20d90271283f73ba
languageName: node
linkType: hard

"minimatch@npm:^3.0.4, minimatch@npm:^3.1.1, minimatch@npm:^3.1.2":
version: 3.1.2
resolution: "minimatch@npm:3.1.2"
Expand Down Expand Up @@ -7879,6 +7971,13 @@ __metadata:
languageName: node
linkType: hard

"minipass@npm:^7.1.2":
version: 7.1.3
resolution: "minipass@npm:7.1.3"
checksum: 8/2ede17c0bf8fec499be3360fd07f0ec7666189e3907320a9b653f1530cf84af98928c5b12d80bfb75f321833bf2e97785b940540213ebdafe97a5f10327e664d
languageName: node
linkType: hard

"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2":
version: 2.1.2
resolution: "minizlib@npm:2.1.2"
Expand Down Expand Up @@ -8457,6 +8556,13 @@ __metadata:
languageName: node
linkType: hard

"package-json-from-dist@npm:^1.0.0":
version: 1.0.1
resolution: "package-json-from-dist@npm:1.0.1"
checksum: 8/58ee9538f2f762988433da00e26acc788036914d57c71c246bf0be1b60cdbd77dd60b6a3e1a30465f0b248aeb80079e0b34cb6050b1dfa18c06953bb1cbc7602
languageName: node
linkType: hard

"package-json@npm:^6.3.0":
version: 6.5.0
resolution: "package-json@npm:6.5.0"
Expand Down Expand Up @@ -8542,6 +8648,16 @@ __metadata:
languageName: node
linkType: hard

"path-scurry@npm:^2.0.0":
version: 2.0.2
resolution: "path-scurry@npm:2.0.2"
dependencies:
lru-cache: ^11.0.0
minipass: ^7.1.2
checksum: 8/a723afe86e342e19dd1b49ce4f5b64a9a84b1e2e07ffc62f051c11623ecd461b1bf1599eee1ecacfce03dda8b6bb866a5df80c0ded45375d258ff22f631920a7
languageName: node
linkType: hard

"path-to-regexp@npm:^6.2.1":
version: 6.2.1
resolution: "path-to-regexp@npm:6.2.1"
Expand Down Expand Up @@ -9019,16 +9135,16 @@ __metadata:
languageName: node
linkType: hard

"resolve@patch:resolve@npm%3A^1.10.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.10.1#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.20.0#optional!builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.4#optional!builtin<compat/resolve>":
"resolve@patch:resolve@npm%3A^1.10.0#~builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.10.1#~builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.20.0#~builtin<compat/resolve>, resolve@patch:resolve@npm%3A^1.22.4#~builtin<compat/resolve>":
version: 1.22.8
resolution: "resolve@patch:resolve@npm%3A1.22.8#optional!builtin<compat/resolve>::version=1.22.8&hash=c3c19d"
resolution: "resolve@patch:resolve@npm%3A1.22.8#~builtin<compat/resolve>::version=1.22.8&hash=c3c19d"
dependencies:
is-core-module: "npm:^2.13.0"
path-parse: "npm:^1.0.7"
supports-preserve-symlinks-flag: "npm:^1.0.0"
bin:
resolve: bin/resolve
checksum: 0446f024439cd2e50c6c8fa8ba77eaa8370b4180f401a96abf3d1ebc770ac51c1955e12764cde449fde3fff480a61f84388e3505ecdbab778f4bef5f8212c729
checksum: 8/5479b7d431cacd5185f8db64bfcb7286ae5e31eb299f4c4f404ad8aa6098b77599563ac4257cb2c37a42f59dfc06a1bec2bcf283bb448f319e37f0feb9a09847
languageName: node
linkType: hard

Expand Down Expand Up @@ -10200,23 +10316,23 @@ __metadata:
languageName: node
linkType: hard

"typescript@patch:typescript@npm%3A^4.1.0#optional!builtin<compat/typescript>, typescript@patch:typescript@npm%3A^4.1.2#optional!builtin<compat/typescript>":
"typescript@patch:typescript@npm%3A^4.1.0#~builtin<compat/typescript>, typescript@patch:typescript@npm%3A^4.1.2#~builtin<compat/typescript>":
version: 4.9.5
resolution: "typescript@patch:typescript@npm%3A4.9.5#optional!builtin<compat/typescript>::version=4.9.5&hash=289587"
resolution: "typescript@patch:typescript@npm%3A4.9.5#~builtin<compat/typescript>::version=4.9.5&hash=d73830"
bin:
tsc: bin/tsc
tsserver: bin/tsserver
checksum: e3333f887c6829dfe0ab6c1dbe0dd1e3e2aeb56c66460cb85c5440c566f900c833d370ca34eb47558c0c69e78ced4bfe09b8f4f98b6de7afed9b84b8d1dd06a1
checksum: 8/2eee5c37cad4390385db5db5a8e81470e42e8f1401b0358d7390095d6f681b410f2c4a0c496c6ff9ebd775423c7785cdace7bcdad76c7bee283df3d9718c0f20
languageName: node
linkType: hard

"typescript@patch:typescript@npm%3A~5.3.2#optional!builtin<compat/typescript>":
"typescript@patch:typescript@~5.3.2#~builtin<compat/typescript>":
version: 5.3.2
resolution: "typescript@patch:typescript@npm%3A5.3.2#optional!builtin<compat/typescript>::version=5.3.2&hash=e012d7"
resolution: "typescript@patch:typescript@npm%3A5.3.2#~builtin<compat/typescript>::version=5.3.2&hash=d73830"
bin:
tsc: bin/tsc
tsserver: bin/tsserver
checksum: 73c8bad74e732d93211c9d77f28b03307e2f5fc6a0afc73f4b783261ab567686a16d6ae958bdaef383a00be1b0b8c8b6741dd6ca3d13af4963fa7e47456d49c7
checksum: 8/c034461079fbfde3cb584ddee52afccb15b6e32a0ce186d0b2719968786f7ca73e1b07f71fac4163088790b16811c6ccf79680de190664ef66ff0ba9c1fe4a23
languageName: node
linkType: hard

Expand Down
Loading