chore: patch security vulnerabilities across JS and Rust apps#277
Open
Nick Robinson (nickrobinson) wants to merge 1 commit intomainfrom
Open
chore: patch security vulnerabilities across JS and Rust apps#277Nick Robinson (nickrobinson) wants to merge 1 commit intomainfrom
Nick Robinson (nickrobinson) wants to merge 1 commit intomainfrom
Conversation
JS apps (javascript-web, javascript-tui, react-native, react-native-expo): - Bump postcss ^8.4.49 → ^8.5.14 in javascript-web (GHSA-qx2v-qp2m-jg93) - Add/update overrides and resolutions to force safe transitive versions: - @xmldom/xmldom → 0.9.10 (GHSA-2v35-w6hq-6mfw, GHSA-f6ww-3ggp-fr8h) - fast-xml-parser → 5.7.2 (GHSA-jp2q-39xq-3w4g, GHSA-gh4j-gqv2-49f6) - yaml → 2.8.4 (GHSA-48c2-rrv3-qjmp) - semver → 7.7.4 (semver ReDoS) - tar → 7.5.11 (hardlink path traversal) - postcss → 8.5.14 in transitive overrides - Regenerate all lockfiles (package-lock.json, yarn.lock) Rust (rust-tui): - Run cargo update to apply latest compatible patch/minor versions Remaining issues requiring manual intervention: - lodash 4.x (GHSA-r5fr-rjxr-66jc): no safe 4.x release; needs lodash 5+ - expo OAuth CRITICAL: embedded in @dittolive/ditto's expo transitive deps - uuid moderate: fix requires uuid >=14.0.0 (not yet released) https://claude.ai/code/session_01QXDwqC7xi7k39vB6wrxfoa
Nick Robinson (nickrobinson)
requested a review
from Kristopher Johnson (kristopherjohnson)
as a code owner
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aims to mitigate reported dependency vulnerabilities across the JavaScript example apps (via npm overrides / Yarn resolutions) and refreshes the Rust TUI app’s dependency lockfile via cargo update.
Changes:
- Bump
postcssinjavascript-weband add cross-app pins for vulnerable transitive JS dependencies (@xmldom/xmldom,yaml,semver,tar,fast-xml-parser, and transitivepostcsswhere relevant). - Update
react-native/react-native-expoYarn lockfiles to reflect newresolutions. - Update
rust-tui/Cargo.lockto latest compatible crate versions.
Reviewed changes
Copilot reviewed 4 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| rust-tui/Cargo.lock | Updates Rust dependency resolution via cargo update. |
| react-native/package.json | Adds/updates Yarn resolutions for vulnerable transitive deps. |
| react-native/yarn.lock | Regenerated to reflect updated resolutions (e.g., xmldom/yaml/semver/tar/postcss). |
| react-native-expo/package.json | Adds/updates resolutions (Yarn) and overrides (npm) pins for vulnerable deps. |
| react-native-expo/yarn.lock | Regenerated to reflect updated resolutions. |
| react-native-expo/package-lock.json | Updated npm lockfile content for the expo app. |
| javascript-web/package.json | Bumps postcss and adds npm overrides for vulnerable transitive deps. |
| javascript-tui/package.json | Adds npm overrides for vulnerable transitive deps (and currently includes an invalid lodash override). |
Files not reviewed (1)
- react-native-expo/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
62
to
+80
| "resolutions": { | ||
| "tar": "7.5.11", | ||
| "undici": "6.24.1", | ||
| "flatted": "3.4.2", | ||
| "fast-xml-parser": "5.5.6" | ||
| "fast-xml-parser": "5.7.2", | ||
| "@xmldom/xmldom": "0.9.10", | ||
| "yaml": "2.8.4", | ||
| "postcss": "8.5.14", | ||
| "semver": "7.7.4" | ||
| }, | ||
| "overrides": { | ||
| "tar": "7.5.11", | ||
| "undici": "6.24.1", | ||
| "flatted": "3.4.2", | ||
| "fast-xml-parser": "5.5.6" | ||
| "fast-xml-parser": "5.7.2", | ||
| "@xmldom/xmldom": "0.9.10", | ||
| "yaml": "2.8.4", | ||
| "postcss": "8.5.14", | ||
| "semver": "7.7.4" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches known security vulnerabilities across all JS apps and updates Rust dependency lockfile. All fixes are minor/patch version bumps — no major version changes or breaking API updates.
What was fixed
postcss</style>in CSS output)^8.4.49→^8.5.14(direct dep injavascript-web)fast-xml-parser5.5.6→5.7.2(overrides inreact-native,react-native-expo)@xmldom/xmldom→ 0.9.10in all JS appsyaml→ 2.8.4in all JS appssemver→ 7.7.4in all JS appstar→ 7.5.11injavascript-web,react-nativepostcss(transitive)→ 8.5.14injavascript-tui,react-native,react-native-exporust-tui:
cargo updateapplied latest compatible patch/minor crate versions (anyhow, clap, futures, tracing-subscriber, uuid, etc.).All lockfiles regenerated:
package-lock.jsonfor npm apps,yarn.lockforreact-nativeandreact-native-expo.MANUAL INTERVENTION REQUIRED
The following cannot be automatically patched:
1.
lodash(HIGH) — GHSA-r5fr-rjxr-66jc, GHSA-f23m-r3pf-42rhjavascript-tui(via@expo/vector-icons → lodash.pick),react-native-expo>=4.0.0 <=4.17.23). There is no safe 4.x release.4.18.1injavascript-tui(pre-existing) — that version does not exist on npm.lodash.pick(deprecated, unmaintained). The@expo/vector-iconsteam would need to update or replace it.2.
expo(CRITICAL) — Expo SDK OAuth vulnerabilityjavascript-web,javascript-tui(transitive via@dittolive/ditto → expo)@dittolive/ditto@4.14.3's dependency tree. Requires a Ditto SDK update that ships with a patched expo version.@dittolive/dittoonce a new release bundles a patched expo SDK.3.
uuid(Moderate) — GHSA-w5hq-g745-h8pq@dittolive/ditto → @expo/config-plugins → xcode → uuid)>=14.0.0, which has not yet been released on npm (latest stable is 9.x).Test plan
javascript-web:npm run buildpassesjavascript-tui:npm run buildpassesreact-native-expo:npm installresolves cleanly (verified locally)react-native:npx yarn installresolves cleanly (verified locally)rust-tui:cargo buildpasses with updatedCargo.lockhttps://claude.ai/code/session_01QXDwqC7xi7k39vB6wrxfoa
Generated by Claude Code