Repository navigation
fix(deps): clear reachable security advisories, drop the @types/tar stub - #546
Merged
Merged
Conversation
`tar` was on 7.5.16 with a critical decompression/parse DoS. This one is genuinely in our threat path rather than theoretical: `playground mod` extracts GitHub tarballs of community-published apps through it, so that parser runs on attacker-controllable input by design. It now resolves to 7.5.22. `@types/tar` is removed. It is a deprecated stub — `tar` has shipped its own types for years, pnpm warns about it on every install, and nothing imports it. It was also the only remaining thing pulling a vulnerable tar 7.5.16 into the tree, so deleting a useless dependency is what actually cleared the critical advisory rather than the version bump alone. Everything else moved within the ranges its parents already declare — no forced resolutions, no new overrides: @libp2p/peer-store, browserslist, postcss, brace-expansion, undici, axios, shell-quote, form-data, baseline-browser-mapping, and vitest/@vitest/mocker. The advisories left open are not reachable and are recorded in the PR: they sit in dev/release tooling (changesets, vitest) or in dependencies that @parity/dotns-cli declares but never resolves, since it ships as a single fully-bundled dist/cli.js. The rest need an upstream bump we cannot make from here.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
|
Dev build ready — try this branch: |
Contributor
E2E Test Pass · ✅ PASSTag:
Sentry traces: view spans for this run |
# Conflicts: # pnpm-lock.yaml
…bumps The 2026-09-29 sync resolved the pnpm-lock.yaml conflict by taking main's lockfile and re-resolving, which silently dropped every lockfile-only bump in this PR (postcss, shell-quote, nanoid, undici, axios, form-data, brace-expansion, @libp2p/peer-store, browserslist, baseline-browser-mapping); only tar survived because package.json drives it. Re-merged from the PR's original commit and let pnpm resolve the conflicted lockfile, which keeps both sides: every bump from 273e788 plus main's versions unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the Dependabot backlog (60 open alerts: 1 critical, 31 high, 25 moderate, 3 low) down to what is actually reachable from the CLI. Branches off
main, independent of #540/#545.The one that mattered
tarwas on 7.5.16 with a critical decompression/parse DoS. This is in our threat path rather than theoretical:src/utils/mod/source.tsextracts GitHub tarballs of community-published apps with it, so that parser runs on attacker-controllable input by design — a malicious moddable app is a supported input toplayground mod, not an exotic scenario.Fixed by the bump to 7.5.22 and by deleting
@types/tar. That package is a deprecated stub (tarships its own types, pnpm warns about it every install, nothing imports it), and it was the only remaining thing pulling a vulnerabletar@7.5.16into the tree. Removing a useless dependency is what actually cleared the last vulnerable copy.Cleared without forced resolutions
All within ranges the parents already declare — no new overrides, so nothing fights the pinning the repo relies on:
@libp2p/peer-store·browserslist·postcss·brace-expansion·undici·axios·shell-quote·form-data·baseline-browser-mapping·vitest+@vitest/mockerLeft open, deliberately — with the reason for each
I traced every remaining alert to its parent rather than forcing versions to make the dashboard green.
deepmerge-ts,esbuild@0.25.12@parity/dotns-cli, which ships as a single fully-bundleddist/cli.jswith deps inlined and never resolved at runtime (documented in CLAUDE.md). Installed but never loaded.js-yaml@3.xchangesets→ release tooling only, never in the shipped binary.vite,image-sizevitest→ dev only.image-sizehas no patched version published.ws@8.20.1viem→@polkadot-api/sdk-ink→@parity/cdm-codegen(pinned EXACT on purpose).nanoid@5.1.11@novasamatech/host-api.@opentelemetry/core@1.30.1@sentry/nodepulls OTel 1.x; the fix is on 2.x, which only Sentry can move to.I tried parent-scoped overrides for
nanoidandws— both patched versions are already in the tree, so it would only have deduped — butws@8.20.1arrives via a peer-dependency variation (isows@1.0.7 peer#7e70) that theparent>childform doesn't match. Rather than leave dead config in the repo, or use a blanket override that would dragws@7.x/nanoid@3.xconsumers across a major, I reverted it. These need the parents to widen their own ranges.Testing
Merged with current
main(includes #540, #545 and #559). All CI checks green, including every E2E cell — #559 fixed the E2E failures that had been red onmainsince late August, none of which were caused by this PR.pnpm test·tsc --noEmitclean ·format:check✓ ·lint:license✓ · the 9 tests covering the tar extraction path pass against 7.5.22.