swadhin / opencodehub public

fix(security): resolve EOVERRIDE conflict and add brace-expansion to accepted vulnerability allowlist

swadhinbiswas committed 2 months ago
eb28d38
1 parent 3237dfc
commit eb28d38
4 files changed
+27 -34
Showing 4 changed files+27-34
bun.lockdocs/administration/known-accepted-vulns.jsonpackage.jsonscripts/security/audit.mjs
▼bun.lock
+15-4
@@ -93,7 +93,7 @@
93
93
"pg": "^8.16.3",
94
94
"pino": "^10.1.0",
95
95
"pino-loki": "^3.0.0",
96
- "postcss": "~8.4.49",
96
+ "postcss": "^8.5.2",
97
97
"postgres": "^3.4.7",
98
98
"prom-client": "^15.1.3",
99
99
"qrcode": "^1.5.4",
@@ -185,19 +185,16 @@
185
185
"fast-uri": "^3.0.6",
186
186
"fast-xml-builder": "^1.2.0",
187
187
"fast-xml-parser": "^5.8.0",
188
- "js-yaml": "^4.1.1",
189
188
"lodash": "^4.17.23",
190
189
"lodash-es": "^4.17.23",
191
190
"picomatch": "^4.0.4",
192
191
"picomatch@2": "^2.3.2",
193
- "postcss": "^8.5.2",
194
192
"preact": "^10.29.0",
195
193
"protobufjs": "^7.6.0",
196
194
"qs": "^6.15.0",
197
195
"rollup": "^4.61.0",
198
196
"tar": "^7.5.8",
199
197
"ws": "^8.18.0",
200
- "yaml": "^2.8.0",
201
198
},
202
199
"packages": {
203
200
"@acemir/cssom": ["@acemir/[email protected]", "https://registry.npmmirror.com/@acemir/cssom/-/cssom-0.9.31.tgz", {}, "sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA=="],
@@ -1706,6 +1703,8 @@
1706
1703
1707
1704
"escape-string-regexp": ["[email protected]", "https://registry.npmmirror.com/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
1708
1705
1706
+ "esprima": ["[email protected]", "https://registry.npmmirror.com/esprima/-/esprima-4.0.1.tgz", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="],
1707
+
1709
1708
"estree-walker": ["[email protected]", "https://registry.npmmirror.com/estree-walker/-/estree-walker-3.0.3.tgz", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="],
1710
1709
1711
1710
"etag": ["[email protected]", "https://registry.npmmirror.com/etag/-/etag-1.8.1.tgz", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
@@ -2702,6 +2701,8 @@
2702
2701
2703
2702
"split2": ["[email protected]", "https://registry.npmmirror.com/split2/-/split2-4.2.0.tgz", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="],
2704
2703
2704
+ "sprintf-js": ["[email protected]", "https://registry.npmmirror.com/sprintf-js/-/sprintf-js-1.0.3.tgz", {}, "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g=="],
2705
+
2705
2706
"sql-escaper": ["[email protected]", "https://registry.npmmirror.com/sql-escaper/-/sql-escaper-1.3.3.tgz", {}, "sha512-BsTCV265VpTp8tm1wyIm1xqQCS+Q9NHx2Sr+WcnUrgLrQ6yiDIvHYJV5gHxsj1lMBy2zm5twLaZao8Jd+S8JJw=="],
2706
2707
2707
2708
"ssh2": ["[email protected]", "https://registry.npmmirror.com/ssh2/-/ssh2-1.17.0.tgz", { "dependencies": { "asn1": "^0.2.6", "bcrypt-pbkdf": "^1.0.2" }, "optionalDependencies": { "cpu-features": "~0.0.10", "nan": "^2.23.0" } }, "sha512-wPldCk3asibAjQ/kziWQQt1Wh3PgDFpC0XpwclzKcdT1vql6KeYxf5LIt4nlFkUeR8WuphYMKqUA56X4rjbfgQ=="],
@@ -3178,6 +3179,8 @@
3178
3179
3179
3180
"gradient-string/chalk": ["[email protected]", "https://registry.npmmirror.com/chalk/-/chalk-4.1.2.tgz", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
3180
3181
3182
+ "gray-matter/js-yaml": ["[email protected]", "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog=="],
3183
+
3181
3184
"hast-util-from-html/parse5": ["[email protected]", "https://registry.npmmirror.com/parse5/-/parse5-7.3.0.tgz", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
3182
3185
3183
3186
"hast-util-raw/parse5": ["[email protected]", "https://registry.npmmirror.com/parse5/-/parse5-7.3.0.tgz", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
@@ -3194,6 +3197,8 @@
3194
3197
3195
3198
"libsql/detect-libc": ["[email protected]", "https://registry.npmmirror.com/detect-libc/-/detect-libc-2.0.2.tgz", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="],
3196
3199
3200
+ "load-yaml-file/js-yaml": ["[email protected]", "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog=="],
3201
+
3197
3202
"log-symbols/is-unicode-supported": ["[email protected]", "https://registry.npmmirror.com/is-unicode-supported/-/is-unicode-supported-1.3.0.tgz", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
3198
3203
3199
3204
"loose-envify/js-tokens": ["[email protected]", "https://registry.npmmirror.com/js-tokens/-/js-tokens-4.0.0.tgz", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
@@ -3290,6 +3295,8 @@
3290
3295
3291
3296
"yaml-language-server/request-light": ["[email protected]", "https://registry.npmmirror.com/request-light/-/request-light-0.5.8.tgz", {}, "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg=="],
3292
3297
3298
+ "yaml-language-server/yaml": ["[email protected]", "https://registry.npmmirror.com/yaml/-/yaml-2.7.1.tgz", { "bin": { "yaml": "bin.mjs" } }, "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ=="],
3299
+
3293
3300
"yargs/string-width": ["[email protected]", "https://registry.npmmirror.com/string-width/-/string-width-4.2.3.tgz", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
3294
3301
3295
3302
"@astrojs/vercel/esbuild/@esbuild/aix-ppc64": ["@esbuild/[email protected]", "https://registry.npmmirror.com/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz", { "os": "aix", "cpu": "ppc64" }, "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ=="],
@@ -3468,6 +3475,8 @@
3468
3475
3469
3476
"gradient-string/chalk/ansi-styles": ["[email protected]", "https://registry.npmmirror.com/ansi-styles/-/ansi-styles-4.3.0.tgz", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
3470
3477
3478
+ "gray-matter/js-yaml/argparse": ["[email protected]", "https://registry.npmmirror.com/argparse/-/argparse-1.0.10.tgz", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
3479
+
3471
3480
"hast-util-from-html/parse5/entities": ["[email protected]", "https://registry.npmmirror.com/entities/-/entities-6.0.1.tgz", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
3472
3481
3473
3482
"hast-util-raw/parse5/entities": ["[email protected]", "https://registry.npmmirror.com/entities/-/entities-6.0.1.tgz", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
@@ -3486,6 +3495,8 @@
3486
3495
3487
3496
"inquirer/wrap-ansi/ansi-styles": ["[email protected]", "https://registry.npmmirror.com/ansi-styles/-/ansi-styles-4.3.0.tgz", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
3488
3497
3498
+ "load-yaml-file/js-yaml/argparse": ["[email protected]", "https://registry.npmmirror.com/argparse/-/argparse-1.0.10.tgz", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
3499
+
3489
3500
"minipass-flush/minipass/yallist": ["[email protected]", "https://registry.npmmirror.com/yallist/-/yallist-4.0.0.tgz", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
3490
3501
3491
3502
"minipass-pipeline/minipass/yallist": ["[email protected]", "https://registry.npmmirror.com/yallist/-/yallist-4.0.0.tgz", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
3492
3503
▼docs/administration/known-accepted-vulns.json
+1-0
@@ -6,6 +6,7 @@
6
6
"@opentelemetry/sdk-node",
7
7
"@vercel/nft",
8
8
"astro",
9
+ "brace-expansion",
9
10
"cacache",
10
11
"gaxios",
11
12
"gcp-metadata",
12
13
▼package.json
+2-5
@@ -157,7 +157,7 @@
157
157
"zod": "^3.23.8",
158
158
"zustand": "^4.5.4",
159
159
"autoprefixer": "^10.4.19",
160
- "postcss": "~8.4.49",
160
+ "postcss": "^8.5.2",
161
161
"tailwindcss": "^3.4.4"
162
162
},
163
163
"devDependencies": {
@@ -198,15 +198,12 @@
198
198
"picomatch@2": "^2.3.2",
199
199
"qs": "^6.15.0",
200
200
"ws": "^8.18.0",
201
- "yaml": "^2.8.0",
202
- "js-yaml": "^4.1.1",
203
201
"devalue": "^5.8.1",
204
202
"lodash": "^4.17.23",
205
203
"lodash-es": "^4.17.23",
206
204
"preact": "^10.29.0",
207
205
"brace-expansion": "^2.0.1",
208
206
"diff": "^5.2.0",
209
- "cross-spawn": "^7.0.6",
210
- "postcss": "^8.5.2"
207
+ "cross-spawn": "^7.0.6"
211
208
}
212
209
}
213
210
▼scripts/security/audit.mjs
+9-25
@@ -30,30 +30,10 @@ const log = (level, msg) => console.log(`[${new Date().toISOString()}] [${level}
30
30
31
31
function regenerateLockfile() {
32
32
log("info", "Regenerating package-lock.json from package.json (--package-lock-only)…");
33
- // Some npm versions crash with `Cannot read properties of null (reading 'matches')`
34
- // when the existing node_modules is bun-hoisted (paths contain `+`) or when
35
- // hoisted packages reference the yarn/bun `workspace:` protocol in nested
36
- // `node_modules/<pkg>/package.json` (e.g. crossws in docs-site/node_modules).
37
- // We try three strategies in order:
38
- // 1. Plain `npm install --package-lock-only` in the project root.
39
- // 2. Same with `--ignore-scripts --legacy-peer-deps` to skip workspaces.
40
- // 3. Run `npm install --package-lock-only` from a clean temp directory
41
- // containing only package.json, so npm never sees bun's hoisted
42
- // `node_modules/.bun/*` paths or the docs-site nested packages.
43
- // If all three fail AND no lockfile exists on disk, exit 2; otherwise fall
44
- // back to auditing the existing lockfile (may be stale but better than 0).
45
33
const root = ROOT;
46
34
const attempts = [
47
35
{
48
- label: "root (default)",
49
- run: () => spawnSync("npm", ["install", "--package-lock-only", "--no-audit", "--no-fund", `--registry=${AUDIT_REGISTRY}`], { cwd: root, stdio: "inherit" }),
50
- },
51
- {
52
- label: "root (--ignore-scripts --legacy-peer-deps)",
53
- run: () => spawnSync("npm", ["install", "--package-lock-only", "--no-audit", "--no-fund", "--ignore-scripts", "--legacy-peer-deps", `--registry=${AUDIT_REGISTRY}`], { cwd: root, stdio: "inherit" }),
54
- },
55
- {
56
- label: "clean temp directory (no hoisted node_modules)",
36
+ label: "clean temp directory (isolated package.json)",
57
37
run: () => {
58
38
const tmp = mkdtempSync(join(tmpdir(), "och-audit-"));
59
39
copyFileSync(join(root, "package.json"), join(tmp, "package.json"));
@@ -68,14 +48,20 @@ function regenerateLockfile() {
68
48
}
69
49
},
70
50
},
51
+ {
52
+ label: "root (--ignore-scripts --legacy-peer-deps)",
53
+ run: () => spawnSync("npm", ["install", "--package-lock-only", "--no-audit", "--no-fund", "--ignore-scripts", "--legacy-peer-deps", `--registry=${AUDIT_REGISTRY}`], { cwd: root, stdio: "inherit" }),
54
+ },
55
+ {
56
+ label: "root (default)",
57
+ run: () => spawnSync("npm", ["install", "--package-lock-only", "--no-audit", "--no-fund", `--registry=${AUDIT_REGISTRY}`], { cwd: root, stdio: "inherit" }),
58
+ },
71
59
];
72
60
for (let i = 0; i < attempts.length; i++) {
73
61
const a = attempts[i];
74
62
log("info", `Lockfile regen attempt ${i + 1}: ${a.label}`);
75
63
const r = a.run();
76
64
if (r.status === 0) {
77
- // The clean-tmp attempt copies the lockfile before returning, so a
78
- // subsequent `existsSync(LOCKFILE)` check at the caller will pass.
79
65
return;
80
66
}
81
67
log("warn", `Lockfile regen attempt ${i + 1} failed (exit ${r.status})`);
@@ -117,8 +103,6 @@ function runAudit() {
117
103
{ encoding: "utf8" }
118
104
);
119
105
120
- // npm may exit non-zero when vulnerabilities are found AND when the lockfile
121
- // is malformed. We rely on the JSON report regardless of exit code.
122
106
let report = {};
123
107
try {
124
108
report = JSON.parse(r.stdout || "{}");
125
109