Repository navigation
Conversation
…M-only htmlparser2@12
PMerlet
changed the title
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
32 fixed, 0 ignored, 50 deferred, 7 resolutions added, 0 resolutions removed, 6 could-not-auto-fix. | label: 🔒 security applied
Fixed
ip-address**/express-rate-limit/ip-address^10.3.1 → ^10.7.1 and added**/socks/ip-address^10.7.1ip-address**/express-rate-limit/ip-address^10.3.1 → ^10.7.1 and added**/socks/ip-address^10.7.1brace-expansion**/minimatch/brace-expansion^2.1.7 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfilebrace-expansion**/minimatch/brace-expansion^2.1.7 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfilebrace-expansion**/minimatch/brace-expansion^2.1.7 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfilemoment**/moment^2.31.0 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfileip-address**/ip-address^10.7.1 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfileip-address**/ip-address^10.7.1 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfilefast-uri**/@fastify/ajv-compiler/fast-uri,**/fast-json-stringify/fast-uri,**/ajv/fast-uri→ ^3.1.8 inpackages/workflow-executor/docker/build-deps-manifest.jsRESOLUTIONS and regenerated lockfilemarkdown-it**/markdown-it^14.3.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1undici**/@actions/http-client/undici,**/node-gyp/undici→ ^6.28.1 and**/@semantic-release/github/undici→ ^7.29.1brace-expansion**/@oclif/core/minimatch/brace-expansion,**/filelist/minimatch/brace-expansion→ ^2.1.7; added**/@redocly/openapi-core/minimatch/brace-expansion^2.1.7brace-expansion**/@oclif/core/minimatch/brace-expansion,**/filelist/minimatch/brace-expansion→ ^2.1.7; added**/@redocly/openapi-core/minimatch/brace-expansion^2.1.7brace-expansion**/nx/brace-expansion^5.0.12; cleared lockfile entries so parents'^5.0.1/^5.0.5ranges re-resolve to 5.0.12brace-expansion**/@oclif/core/minimatch/brace-expansion,**/filelist/minimatch/brace-expansion→ ^2.1.7; added**/@redocly/openapi-core/minimatch/brace-expansion^2.1.7brace-expansion^1.1.7moment**/moment^2.31.0ip-address**/express-rate-limit/ip-address^10.3.1 → ^10.7.1 and added**/socks/ip-address^10.7.1@nestjs/platform-fastify@nestjs/platform-fastify^11.2.4axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0axiosaxios^1.18.0 → ^1.20.0Ignored
None this run.
Deferred
Alerts opened less than 7 days ago, deferred to the next run:
#578, #579, #580, #581, #582, #584, #585, #586, #588, #589, #590, #591, #592, #593, #594, #595, #596, #597, #598, #599, #600, #602, #603, #604, #605, #606, #607, #608, #609, #610, #611, #612, #613, #614, #615, #616, #617, #618, #619, #620, #621, #622, #623, #624, #625, #626, #627, #628, #629, #630
Resolutions added
**/socks/ip-address^10.7.1@forestadmin/datasource-sql→ sequelize/mariadb →socks(pins ^10.0.1)@nestjs/platform-fastify^11.2.4agent(devDep),_example(direct dep) both pin^11.1.24which semver-allows 11.2.4**/moment^2.31.0 (root) and**/moment^2.31.0 (workflow-executor docker RESOLUTIONS)sequelize@6andmoment-timezonewhich pin^2.19.0/^2.29.4**/markdown-it^14.3.1 (root)typedoc@^0.28^14.1.1; semver already allowed 14.3.1 but lockfile stuck at 14.3.0**/nx/brace-expansion^5.0.12nx@22depends on exact5.0.6(no semver range)**/@redocly/openapi-core/minimatch/brace-expansion^2.1.7@forestadmin/agent-bff→redoc→@redocly/openapi-core→minimatch@5.1.9→brace-expansion@^2.0.1^2.0.1**/minimatch/brace-expansion^2.1.7 (workflow-executor docker RESOLUTIONS)Resolutions updated in place (not new):
**/express-rate-limit/ip-address^10.3.1 → ^10.7.1;axios^1.18.0 → ^1.20.0;**/@actions/http-client/undici^6.28.0 → ^6.28.1;**/node-gyp/undici^6.28.0 → ^6.28.1;**/@semantic-release/github/undici^7.29.0 → ^7.29.1;**/@oclif/core/minimatch/brace-expansion^2.1.4 → ^2.1.7;**/filelist/minimatch/brace-expansion^2.1.4 → ^2.1.7;**/@fastify/ajv-compiler/fast-uri^3.1.6 → ^3.1.8 (workflow-executor docker);**/fast-json-stringify/fast-uri^3.1.6 → ^3.1.8 (workflow-executor docker);**/ajv/fast-uri^3.1.6 → ^3.1.8 (workflow-executor docker).Resolutions removed
None this run — a redundancy sweep was out of scope for this patch batch (every existing pin was verified still-present in the resolved tree, none stale).
Could not auto-fix
sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.sanitize-htmlto patched releasehtmlparser2@^12, breaks Jest in all BFF test suites (CommonJS). Seefix(security): address CI failurecommit on this branch.Common blocker: Bumping
sanitize-htmlfrom 2.17.5 → 2.17.7 (first attempt) and 2.17.6 (second attempt) both fail CI: both patched versions declarehtmlparser2@^12.0.0, which is a pure-ESM package (type: module) and Jest (CommonJS) chokes onimport { Parser } from "./Parser.js". Fix requires either (a) addingtransformIgnorePatterns+ ESM Jest wiring to every workspace that transitively importssanitize-html(goes beyond "minor test adjustments tied to a specific bump"), or (b) overridinghtmlparser2back to^10.1.0via a resolution — but sanitize-html 2.17.6+ was written against the 12.x API, so this could silently misbehave at runtime. Leaving at 2.17.5 pending a human decision.Risks
Per bump, from upstream CHANGELOGs:
forest-cloudis simple HTTP posts; low risk.datasource-sql's use viasocksonly touches hostname resolution, not these classifier methods.BalancedPooland fixes Set-Cookie leakage. Transitive vianode-gyp,@actions/http-client,@semantic-release/github; no direct usage in our code.agent(tests only) and a regular dep in private_example; not shipped.sequelize's date formatting; no locale paths are user-controlled.minimatchundereslint,jest,lerna,nx,@oclif/core,@redocly/openapi-core, etc. Low risk.typedocon our own source code — never user-controlled markdown.Manual testing
Covered by CI (unit + integration suites per workspace, Docker build smoke tests under
packages/*/docker/smoke-test.sh). The two regenerated docker lockfiles will be re-exercised by the Docker build steps with--frozen-lockfile.Pre-push lint note:
yarn eslint packages/workflow-executor/docker/build-deps-manifest.jsreports 10 pre-existing errors (@typescript-eslint/no-var-requires,no-continue,padding-line-between-statements,no-use-before-define) that are not in lines I touched. Scope rule says leave pre-existing issues alone. Prettier passed on all changed files.Validation
✅ CI green (Actions + commit statuses; app-based checks not monitored)