fix: bump dependencies and resolve security vulnerabilities - #445
Merged
Conversation
Close the security advisories reachable through the published @frontegg/nextjs package and the example apps. SDK production chain (enforced via root "resolutions"): - follow-redirects -> ^1.16.0 (proxy/auth header leak; via http-proxy) - cookie -> ^0.7.0 (out-of-bounds cookie parsing; via iron-session) - @babel/runtime -> ^7.26.10 (inefficient RegExp; via @frontegg/js) Example apps: - next / eslint-config-next 14.2.0 -> 14.2.35 (fixes the critical middleware authorization bypass CVE-2025-29927 and other 14.2.x CVEs) Also add a Security section to the README documenting the patched dependency posture and responsible disclosure to security@frontegg.com. Verified: `yarn build` and `yarn test` (@frontegg/nextjs) pass. Known residual: a moderate advisory in `uuid` remains inside the vendored @frontegg/redux-store bundle; its fix requires uuid v11 (a major bump) and the affected code path (v3/v5/v6 with a buffer) is not exercised, so a global override is not applied here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
dianaKhortiuk-frontegg
requested review from
MaxArnautFrontegg,
TomerFrontegg,
aviadmizrachi,
frontegg-david,
mariavlasov,
raz-shlomo-frontegg and
vladFrontegg
as code owners
July 14, 2026 00:26
`scripts/build.js` throws when the babel compile step writes anything to stderr (except Node/babel deprecation warnings). The pinned caniuse-lite had aged ~9 months, so Browserslist printed a "browsers data is 9 months old" staleness warning to stderr, failing `yarn build:stable` in CI. This is a pre-existing, time-based issue (caniuse-lite was identical on master), surfaced by this PR's fresh CI run. Ran `update-browserslist-db` to bump caniuse-lite to 1.0.30001805; the babel step now emits no stderr and the build passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/build.js treats any babel stderr output (other than Node/babel deprecation warnings) as a build failure. When caniuse-lite ages past ~6 months, Browserslist prints a "browsers data is N months old" notice to stderr, which fails `yarn build:stable` in CI for reasons unrelated to the actual change. Add `Browserslist` to the ignore pattern so this informational notice is not treated as a failure. The companion caniuse-lite refresh fixes the current instance; this prevents the build from breaking again as the data ages. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vladFrontegg
approved these changes
Jul 14, 2026
dianaKhortiuk-frontegg
added a commit
that referenced
this pull request
Jul 15, 2026
Resolve conflicts from the merged deps/security PR (#445): - scripts/build.js: both branches added the Browserslist stderr-ignore fix; keep the combined `Browserslist|caniuse-lite` pattern. - yarn.lock: regenerated via `yarn install` to reconcile master's dependency/security updates (resolutions, refreshed caniuse-lite) with this branch's test tooling (vitest, jsdom). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the security advisories reachable through the published
@frontegg/nextjspackage, plus the critical Next.js advisory in the example apps.This is a lerna/yarn-workspaces monorepo; the vast majority of
yarn auditfindings are in dev tooling (lerna, jest, webpack, babel, eslint, danger, tslint) which is not shipped to consumers and is not gated by CI. This PR deliberately scopes to what reaches SDK consumers and the one critical example-app runtime CVE, rather than forcing risky multi-major overrides across the build toolchain.Changes
SDK production chain — enforced via the root
resolutionsfield:follow-redirects→^1.16.0— Proxy-Authorization / auth header leakage (viahttp-proxy)cookie→^0.7.0— out-of-bounds characters in cookie parsing (viairon-session)@babel/runtime→^7.26.10— inefficient RegExp complexity (via@frontegg/js)Resolved versions after install:
follow-redirects 1.16.0,cookie 0.7.2,@babel/runtime 7.29.7.Example apps:
next/eslint-config-next14.2.0→14.2.35— fixes the critical Next.js middleware authorization bypass (CVE-2025-29927) and other 14.2.x advisories (cache poisoning, DoS, etc.)Docs:
Verification
yarn build(@frontegg/nextjs): passedyarn test(@frontegg/nextjs): passed (21 tests)Known residual
A moderate
uuidadvisory remains inside the vendored@frontegg/redux-storebundle (via@frontegg/react-hooks). Its fix requiresuuidv11 (a major bump); the vulnerable path (v3/v5/v6with abufargument) is not exercised by these bundles, so a global override is intentionally not applied to avoid build breakage. Best addressed by a future bump of the@frontegg/js/@frontegg/react-hooksline.🤖 Generated with Claude Code