Improve GHSA-28xv-ph75-77wh: add Crow 4.x patched range - #9137
Open
marshallswain wants to merge 1 commit into
Conversation
The published global advisory used a single ecosystem range introduced=0 fixed=5.0.45, which incorrectly marks all Feathers 4.x (Crow) releases of @feathersjs/commons as vulnerable. The repository advisory already documents two lines: - Crow: introduced 4.0.0, fixed 4.5.20 - Dove: introduced 5.0.0, fixed 5.0.45 This update aligns the OSV record with those ranges, expands the details/references to include the Crow fix (github#3695, v4.5.20/v4.5.21), and stops npm audit false positives on 4.5.20+ (e.g. feathers-mongoose trees resolving to 4.5.21). Refs: - GHSA-28xv-ph75-77wh - feathersjs/feathers#3690 - feathersjs/feathers#3695
github-actions
Bot
changed the base branch from
main
to
marshallswain/advisory-improvement-9137
August 16, 2026 15:56
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the advisory to distinguish patched Crow and Dove release lines.
Changes:
- Splits affected ranges by major version.
- Documents Crow fixes and releases.
- Updates references and modification timestamp.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| "introduced": "4.0.0" |
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "5.0.0" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reason for change
The global GitHub Advisory Database record for GHSA-28xv-ph75-77wh / CVE-2026-54335 currently uses a single ecosystem range:
05.0.45<= 5.0.44That incorrectly marks all Feathers 4.x (Crow) releases of
@feathersjs/commonsas vulnerable, including4.5.20and4.5.21, which already contain the fix.As a result,
npm auditfalse-positives clean installs such as:feathers-mongoose@8.x→@feathersjs/commons@4.5.21Correct affected ranges
These match the published repository security advisory:
GHSA-28xv-ph75-77wh
4.0.04.5.20<= 4.5.195.0.05.0.45<= 5.0.44Supporting references
I am a maintainer of
feathersjs/feathersand publisher of the original repository advisory.What this PR changes
affectedinto Crow + Dove ecosystem rangesdetails/ references to include the Crow fixmodifiedtimestampPlease re-review so npm audit / Dependabot stop flagging
@feathersjs/commons@4.5.20+.