chore(deps): patch dependency vulnerabilities (audit fix + qs/brace-expansion overrides) - #233
Merged
Merged
Conversation
…ce-expansion overrides) - npm audit fix: non-breaking transitive bumps in npm-shrinkwrap.json (clears postcss, dompurify, nanoid, fast-xml-parser, undici, mermaid, fast-uri, js-yaml-dev alerts) — 51 -> 38 advisories. - overrides.qs 6.14.2 -> 6.16.0 (root + @sap/cds-dk): patches qs array-limit/DoS advisories on all non-bundled paths. - overrides.brace-expansion ^5.0.9: patches the unbounded-expansion DoS on all non-bundled paths (wdio/glob/minimatch chain, body-parser). Unit/CI suite green (566 passing). Remaining advisories are not fixable from this manifest: they live in bundled deps inside @sap/cds-dk (a peerDependency, provided by the consumer env) and in nested copies shipped inside sap-hdb-promisfied and exceljs (upstream fixes), plus the legacy wdio 'devtools'/puppeteer dev-test chain (needs a wdio v9 BiDi migration, tracked separately).
# Conflicts: # npm-shrinkwrap.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
General dependency refresh focused on clearing Dependabot /
npm auditadvisories.Changes
npm audit fix(non-breaking) — transitive bumps innpm-shrinkwrap.json. Clears thepostcss,dompurify,nanoid,fast-xml-parser,undici,mermaid,fast-uri, and devjs-yamladvisories.overrides.qs^6.14.2→^6.16.0(root +@sap/cds-dk) — patches the qs array-limit / DoS advisories on every non-bundled path.overrides.brace-expansion^5.0.9— patches the unbounded-expansion DoS on theglob/minimatch/body-parser/wdio chains.Advisory count: 51 → 38. Unit/CI suite green — 566 passing, 0 failing (
npm run test:ci).Remaining advisories — not fixable from this manifest
Documented here so they aren't mistaken for missed work:
@sap/cds-dkbundled deps (qs,brace-expansion, and the package itself, plus@cap-js/postgreswhich pulls it).@sap/cds-dkbundles 107 dependencies, sooverridescannot rewrite them — and it is apeerDependency, i.e. provided by the consumer's environment and not part of hana-cli's shipped dependency closure. Fix is an upstream@sap/cds-dkrelease.sap-hdb-promisfiednestedbrace-expansion@2.1.2/js-yaml@4.x— this package ships a stray nestednode_modules, so overrides don't reach them. Fix belongs upstream insap-hdb-promisfied.exceljs→uuid@^8.3.0— advisory is a missing buffer bounds-check inv3/v5/v6whenbufis provided; exceljs only usesuuid.v4()withoutbuf, so it is not reachable. The only npm-suggested "fix" is an exceljs major downgrade.devtools/ puppeteer dev-test chain (devtools,@wdio/devtools-service→puppeteer-core,tar-fs,extract-zip,adm-zip,chromedriver) — the bulk of the remaining dev-only high alerts. Every npm-suggested fix is a major downgrade (e.g.webdriverio@8.14.6from^9.27.1). The real fix is migratingwdio.conf.jsoff the'devtools'service to the WebDriver BiDi protocol (wdio v9 default) and dropping those devDeps — a test-config change that needs a UI-suite run to validate, so it is intentionally out of scope for this PR.No runtime (production) dependency of hana-cli itself carries an unpatched, reachable advisory after this change.