fix(deps): bump fast-uri override; dismiss stream-json alert as not-used - #98
Merged
Merged
Conversation
Adds a pnpm.overrides entry for stream-json (transitive dep of minio, resolved 3.4.0 -> 3.6.0) to clear the open medium Dependabot alert #175. No source code touches stream-json directly; frozen-lockfile install verified clean.
Existing override floor >=3.1.2 still admitted the vulnerable 4.x range (resolved 4.1.2), leaving alerts #169-172 open (all high). Bump to >=4.1.3; resolved 4.1.4. frozen-lockfile install verified clean.
acamarata
changed the title
The stream-json >=3.5.0 override broke the Next.js webpack build: minio@8.0.7 declares stream-json ^1.8.0 and imports only stream-json/jsonl/Parser.js. Every version that fixes GHSA-528h-pc64-c93x (>=3.5.0) is also a full ESM rewrite (files moved under src/, exports map added) that no longer exposes that path, producing 'Module not found: stream-json/jsonl/Parser.js' during 'next build --webpack' (Multi-Arch Check job, both amd64 and arm64). The vulnerable code (pick/ignore/filter/replace path filters in filter-base.js, an O(depth^2) DoS) is never invoked by minio's notification listener, which only uses the unrelated JSONL parser -- confirmed by grepping minio's dist/esm for every stream-json import. No newer minio release exists (8.0.7 is latest). Reverted the override; stream-json now resolves to 1.9.1 via minio's own declared range, matching main. Dismissed Dependabot alert #175 via gh api with reason not_used and a comment explaining the unreachable code path. Verified 'pnpm run build' passes locally (previously failed with the override in place).
acamarata
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
"fast-uri": ">=3.1.2"override to">=4.1.3"to clear GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp (alerts #169-172, all high). The old>=3.1.2floor still admitted the vulnerable 4.x range (resolved 4.1.2).stream-jsonmedium, GHSA-528h-pc64-c93x) is dismissed asnot_used, not fixed by a version bump. Details below.Why stream-json is dismissed, not bumped
An earlier commit on this branch added
"stream-json": ">=3.5.0", which broke the Next.js webpack build (Multi-Arch Checkfailed on both amd64 and arm64:Module not found: Can't resolve 'stream-json/jsonl/Parser.js'). Root cause:minio@8.0.7(latest; no newer release exists) declaresstream-json: ^1.8.0and imports onlystream-json/jsonl/Parser.js(S3 event-notification JSONL parsing).>=3.5.0) is also a full ESM rewrite: files moved undersrc/,package.jsongained"type": "module"and a restrictiveexportsmap ("./*": "./src/*").stream-json/jsonl/Parser.jsno longer resolves under any fixed version.pick/ignore/filter/replacepath filters,filter-base.js) lives in code minio never imports — confirmed by grepping minio'sdist/esm/*.mjsfor everystream-jsonimport; only the unrelated JSONL parser is used.Reverted the override;
stream-jsonnow resolves to1.9.1via minio's own declared range (same asmain). Dismissed alert #175 viagh api(reason: not_used) with a comment linking this reasoning and PR.Resolved versions
>=3.1.2->>=4.1.3not_used)Test plan
pnpm install --no-frozen-lockfile(underheavy-lock, x3 across the branch's history) — final state resolves fast-uri@4.1.4, stream-json@1.9.1pnpm install --frozen-lockfile— exit 0pnpm run build(the exact commandMulti-Arch Checkruns inside Docker) — passes locally, confirming the fix; previously failed with the stream-json override in placepnpm audit --prod— timed out (npm advisory endpoint outage, unrelated); resolved versions verified directly in pnpm-lock.yaml insteadpnpm why stream-jsonconfirms onlyminio -> stream-json, no direct usage insrc/Ticket: P6 DEPS-ADVISORIES unit (nself PPI phase P6)