From 5fb5bdf0b1691ce436a73b3f8b1cb62f22558ad6 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 3 Sep 2026 23:32:11 -0400 Subject: [PATCH 1/3] fix(deps): bump stream-json override to >=3.5.0 (GHSA-528h-pc64-c93x) Adds a pnpm.overrides entry for stream-json (transitive dep of minio, resolved 3.4.0 -> 3.6.0) to clear the open medium Dependabot alert #175. No source code touches stream-json directly; frozen-lockfile install verified clean. --- package.json | 1 + pnpm-lock.yaml | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index 879d2b87..aa83130f 100644 --- a/package.json +++ b/package.json @@ -81,6 +81,7 @@ "@grpc/grpc-js": ">=1.14.4", "fast-uri": ">=3.1.2", "fast-xml-builder": ">=1.1.7", + "stream-json": ">=3.5.0", "browserslist@<4.28.7": "^4.28.7" } }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 11163e1b..0855ba29 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -18,6 +18,7 @@ overrides: '@grpc/grpc-js': '>=1.14.4' fast-uri: '>=3.1.2' fast-xml-builder: '>=1.1.7' + stream-json: '>=3.5.0' browserslist@<4.28.7: ^4.28.7 importers: @@ -5929,11 +5930,12 @@ packages: resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==} engines: {node: '>= 0.4'} - stream-chain@2.2.5: - resolution: {integrity: sha512-1TJmBx6aSWqZ4tx7aTpBDXK0/e2hhcNSTV8+CbFJtDjbb+I1mZ8lHit0Grw9GRT+6JbIrrDd8esncgBi8aBXGA==} + stream-chain@4.2.5: + resolution: {integrity: sha512-Wtyq3bNE3ggLR0v2vftqvuhltym3WbZAkZpfIrkr5F/6vpeUmWmwTgXa16zD87gpahwJ/Qulq3zVfUlgIc0J2A==} + engines: {node: '>=22'} - stream-json@1.9.1: - resolution: {integrity: sha512-uWkjJ+2Nt/LO9Z/JyKZbMusL8Dkh97uUBTv3AJQ74y07lVahLY4eEFsPsE97pxYBwr8nnjMAIch5eqI0gPShyw==} + stream-json@3.6.0: + resolution: {integrity: sha512-NiJdqxKyau579z/E8vfqcjWfSDWxW/AT99javFXdPXF147Z5za85LRXSHEmSX9TKOakB7gaIccfD0fOIctb7KQ==} strict-uri-encode@2.0.0: resolution: {integrity: sha512-QwiXZgpRcKkhTj2Scnn++4PKtWsH0kpzZ62L2R6c/LUVYv7hVnZqcg2+sMuT6R7Jusu1vviK/MFsu6kNJfWlEQ==} @@ -12074,7 +12076,7 @@ snapshots: lodash: 4.18.1 mime-types: 2.1.35 query-string: 7.1.3 - stream-json: 1.9.1 + stream-json: 3.6.0 through2: 4.0.2 xml2js: 0.6.2 @@ -13076,11 +13078,11 @@ snapshots: es-errors: 1.3.0 internal-slot: 1.1.0 - stream-chain@2.2.5: {} + stream-chain@4.2.5: {} - stream-json@1.9.1: + stream-json@3.6.0: dependencies: - stream-chain: 2.2.5 + stream-chain: 4.2.5 strict-uri-encode@2.0.0: {} From 6dfd56de31c21bd5cf12579f1c99011d8c402b7f Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 3 Sep 2026 23:53:00 -0400 Subject: [PATCH 2/3] fix(deps): bump fast-uri override to >=4.1.3 (GHSA-5jgf-p345-68v8 et al) Existing override floor >=3.1.2 still admitted the vulnerable 4.x range (resolved 4.1.2), leaving alerts #169-172 open (all high). Bump to >=4.1.3; resolved 4.1.4. frozen-lockfile install verified clean. --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index aa83130f..b9ba8e2f 100644 --- a/package.json +++ b/package.json @@ -79,7 +79,7 @@ "protobufjs": ">=7.2.4 <8.0.0", "lodash": ">=4.18.1", "@grpc/grpc-js": ">=1.14.4", - "fast-uri": ">=3.1.2", + "fast-uri": ">=4.1.3", "fast-xml-builder": ">=1.1.7", "stream-json": ">=3.5.0", "browserslist@<4.28.7": "^4.28.7" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0855ba29..ab79fe18 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -16,7 +16,7 @@ overrides: protobufjs: '>=7.2.4 <8.0.0' lodash: '>=4.18.1' '@grpc/grpc-js': '>=1.14.4' - fast-uri: '>=3.1.2' + fast-uri: '>=4.1.3' fast-xml-builder: '>=1.1.7' stream-json: '>=3.5.0' browserslist@<4.28.7: ^4.28.7 @@ -3934,8 +3934,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@4.1.2: - resolution: {integrity: sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==} + fast-uri@4.1.4: + resolution: {integrity: sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} @@ -9380,7 +9380,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 4.1.2 + fast-uri: 4.1.4 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -10497,7 +10497,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@4.1.2: {} + fast-uri@4.1.4: {} fast-xml-builder@1.2.0: dependencies: From 59487b6f7c4bb2a79a18566ed5a81de1df379d3f Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Fri, 4 Sep 2026 00:11:34 -0400 Subject: [PATCH 3/3] fix(deps): revert stream-json override, dismiss alert #175 as not-used The stream-json >=3.5.0 override broke the Next.js webpack build: minio@8.0.7 declares stream-json ^1.8.0 and imports only stream-json/jsonl/Parser.js. Every version that fixes GHSA-528h-pc64-c93x (>=3.5.0) is also a full ESM rewrite (files moved under src/, exports map added) that no longer exposes that path, producing 'Module not found: stream-json/jsonl/Parser.js' during 'next build --webpack' (Multi-Arch Check job, both amd64 and arm64). The vulnerable code (pick/ignore/filter/replace path filters in filter-base.js, an O(depth^2) DoS) is never invoked by minio's notification listener, which only uses the unrelated JSONL parser -- confirmed by grepping minio's dist/esm for every stream-json import. No newer minio release exists (8.0.7 is latest). Reverted the override; stream-json now resolves to 1.9.1 via minio's own declared range, matching main. Dismissed Dependabot alert #175 via gh api with reason not_used and a comment explaining the unreachable code path. Verified 'pnpm run build' passes locally (previously failed with the override in place). --- package.json | 1 - pnpm-lock.yaml | 18 ++++++++---------- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/package.json b/package.json index b9ba8e2f..7f84029f 100644 --- a/package.json +++ b/package.json @@ -81,7 +81,6 @@ "@grpc/grpc-js": ">=1.14.4", "fast-uri": ">=4.1.3", "fast-xml-builder": ">=1.1.7", - "stream-json": ">=3.5.0", "browserslist@<4.28.7": "^4.28.7" } }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ab79fe18..e0f690aa 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -18,7 +18,6 @@ overrides: '@grpc/grpc-js': '>=1.14.4' fast-uri: '>=4.1.3' fast-xml-builder: '>=1.1.7' - stream-json: '>=3.5.0' browserslist@<4.28.7: ^4.28.7 importers: @@ -5930,12 +5929,11 @@ packages: resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==} engines: {node: '>= 0.4'} - stream-chain@4.2.5: - resolution: {integrity: sha512-Wtyq3bNE3ggLR0v2vftqvuhltym3WbZAkZpfIrkr5F/6vpeUmWmwTgXa16zD87gpahwJ/Qulq3zVfUlgIc0J2A==} - engines: {node: '>=22'} + stream-chain@2.2.5: + resolution: {integrity: sha512-1TJmBx6aSWqZ4tx7aTpBDXK0/e2hhcNSTV8+CbFJtDjbb+I1mZ8lHit0Grw9GRT+6JbIrrDd8esncgBi8aBXGA==} - stream-json@3.6.0: - resolution: {integrity: sha512-NiJdqxKyau579z/E8vfqcjWfSDWxW/AT99javFXdPXF147Z5za85LRXSHEmSX9TKOakB7gaIccfD0fOIctb7KQ==} + stream-json@1.9.1: + resolution: {integrity: sha512-uWkjJ+2Nt/LO9Z/JyKZbMusL8Dkh97uUBTv3AJQ74y07lVahLY4eEFsPsE97pxYBwr8nnjMAIch5eqI0gPShyw==} strict-uri-encode@2.0.0: resolution: {integrity: sha512-QwiXZgpRcKkhTj2Scnn++4PKtWsH0kpzZ62L2R6c/LUVYv7hVnZqcg2+sMuT6R7Jusu1vviK/MFsu6kNJfWlEQ==} @@ -12076,7 +12074,7 @@ snapshots: lodash: 4.18.1 mime-types: 2.1.35 query-string: 7.1.3 - stream-json: 3.6.0 + stream-json: 1.9.1 through2: 4.0.2 xml2js: 0.6.2 @@ -13078,11 +13076,11 @@ snapshots: es-errors: 1.3.0 internal-slot: 1.1.0 - stream-chain@4.2.5: {} + stream-chain@2.2.5: {} - stream-json@3.6.0: + stream-json@1.9.1: dependencies: - stream-chain: 4.2.5 + stream-chain: 2.2.5 strict-uri-encode@2.0.0: {}