fix(deps): raise fast-uri floor, prep apps/mobile CVE overrides - #172
Merged
Merged
Conversation
…rgets Root: fast-uri override floor raised 3.1.5 -> 3.1.6 (resolved 3.1.7), clearing alerts #43-46 (host-confusion / SSRF via IDN and IPv6/percent normalization bugs, all high). apps/mobile: adds/corrects override targets for js-yaml (now scoped to both the 3.x and 4.x lines it actually resolves, was only catching 4.x and only up to 4.2.0), nanoid, brace-expansion (1.x + 2.x line-scoped), tar, shell-quote, postcss -- clearing alerts #1-6,#9,#11-14,#20,#22-25, just never installed). NOT applied to apps/mobile/pnpm-lock.yaml in this commit: that file is apps/mobile's own separate lockfile (its dependencies are declared workspace:* against the sibling nself-org/packages clone), but neither a plain `pnpm install` from apps/mobile (walks up and writes to the ROOT shared lockfile instead, since apps/mobile is a listed member of the root pnpm-workspace.yaml) nor `--ignore-workspace` (breaks immediately on "@nself/auth-core@workspace:*" once workspace resolution is off) regenerates it locally. CI's mobile-test job runs `pnpm install --frozen-lockfile` from apps/mobile and appears to expect a genuinely standalone lockfile there via some mechanism this sweep could not reproduce outside that runner. Logged in the P6 residue register for the manager -- the override targets above are ready to take effect once someone with the working local recipe (or CI itself, if it's set up for auto-commit) regenerates that file. Ticket: P6 DEPENDABOT-HIGH-SWEEP unit (nself PPI phase P6)
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Dependency Audit (OSV) job on PR #172 caught two fixable mediums in the root lockfile that weren't in the original Dependabot high/critical sweep: - @xmldom/xmldom: existing unscoped override '^0.9.10' bumped to a 0.9.x-scoped '@xmldom/xmldom@>=0.9.0 <1': '>=0.9.12' (GHSA-6gmq-8vp8-gcm6) - qs: new override '>=6.16.0' (GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx) Both resolved and verified in pnpm-lock.yaml (xmldom 0.9.12, qs 6.16.0). image-size is already filtered out of this OSV gate (no fix available, per the earlier P6 residue-register entry). Ticket: P6 DEPENDABOT-HIGH-SWEEP unit (nself PPI phase P6)
The prior commit's '@xmldom/xmldom@>=0.9.0 <1' scope left a second resolution at 0.7.13 untouched (a different @expo/plist major pins '^0.7'), carrying 5 open high alerts (GHSA-2v35-w6hq-6mfw, GHSA-f6ww-3ggp-fr8h, GHSA-j759-j44w-7fr8 -> fixed 0.8.13; GHSA-wh4c-j3r5-mjhp -> 0.8.12; GHSA-6gmq-8vp8-gcm6 -> 0.8.15). Adds a second scoped override '@xmldom/xmldom@>=0.7.0 <0.9.0': '>=0.8.15' alongside the existing 0.9.x one. Both @expo/plist@0.2.2 and @expo/plist@0.3.5 now dedupe onto the same 0.9.12 resolution -- 'pnpm -r why @xmldom/xmldom' reports 'Found 1 version of @xmldom/xmldom' across the whole workspace tree. Also verified (no code change needed, already fixed by the pre-existing root override): tar -- 'pnpm -r why tar' shows a single tar@7.5.22 resolution workspace-wide, satisfying GHSA-23hp-3jrh-7fpw's 7.5.19 floor. That advisory's Dependabot alert (#18, critical) is filed against apps/mobile/pnpm-lock.yaml specifically, a separate, disconnected lockfile this sweep has already documented as unreachable via any local pnpm install (see prior commit + P6 residue register) -- root being clean does not close that alert. Ticket: P6 DEPENDABOT-HIGH-SWEEP unit (nself PPI phase P6)
apps/mobile is a pnpm workspace member, so pnpm never reads this file; the root lockfile governs. It only fed Dependabot 29 high/critical alerts (incl. tar GHSA-23hp-3jrh-7fpw) against versions nothing installs.
apps/mobile/pnpm-lock.yaml was removed (dead nested lockfile); setup-node fails hard when cache-dependency-path matches nothing.
acamarata
added a commit
that referenced
this pull request
Sep 13, 2026
ntask main's Dependency Audit (OSV) went red on 2026-09-13 against commit 4fa5078 — the same commit that passed on 09-04 and 09-06. The code did not change; the advisory database did. hono@<4.13.5 -> ^4.13.5 js-yaml@<4.3.2 -> ^4.3.2 vitest@<4.1.11 -> ^4.1.11 but pnpm-lock.yaml was never regenerated, so it still pinned hono@4.13.2, js-yaml@4.3.1 and vitest@3.2.6. OSV scans the lockfile, not the override block, so those overrides were inert and the audit stayed red. This is the missing half of #172. After a fresh install the lockfile resolves hono@4.13.7, js-yaml@4.3.2 and vitest@4.1.11. The vitest override crosses a major, so the three packages that declare it (web, apps/cli, apps/mcp) move from ^3.2.6 to ^4.1.11 to match rather than silently diverge from the resolved tree. Vitest 4 also removed the "poolOptions" nesting — those per-pool settings are top-level options now — so web/vitest.config.ts is migrated, which clears the DEPRECATED warning the first v4 run emitted. Behaviour is unchanged: one bounded fork, same 2GB execArgv ceiling. Verified locally on 4.1.11: web 28 files / 461 tests pass apps/cli 4 files / 16 tests pass apps/mcp 1 file / 2 tests pass sharded coverage gate: lines 54.05% >= 54%, functions 46.65% >= 40%, branches 44.61% >= 40% No gate weakened: no IgnoredVulns entry added, no threshold lowered, no test skipped.
acamarata
added a commit
that referenced
this pull request
Sep 13, 2026
) * fix(deps): regenerate lockfile so the CVE overrides actually apply ntask main's Dependency Audit (OSV) went red on 2026-09-13 against commit 4fa5078 — the same commit that passed on 09-04 and 09-06. The code did not change; the advisory database did. hono@<4.13.5 -> ^4.13.5 js-yaml@<4.3.2 -> ^4.3.2 vitest@<4.1.11 -> ^4.1.11 but pnpm-lock.yaml was never regenerated, so it still pinned hono@4.13.2, js-yaml@4.3.1 and vitest@3.2.6. OSV scans the lockfile, not the override block, so those overrides were inert and the audit stayed red. This is the missing half of #172. After a fresh install the lockfile resolves hono@4.13.7, js-yaml@4.3.2 and vitest@4.1.11. The vitest override crosses a major, so the three packages that declare it (web, apps/cli, apps/mcp) move from ^3.2.6 to ^4.1.11 to match rather than silently diverge from the resolved tree. Vitest 4 also removed the "poolOptions" nesting — those per-pool settings are top-level options now — so web/vitest.config.ts is migrated, which clears the DEPRECATED warning the first v4 run emitted. Behaviour is unchanged: one bounded fork, same 2GB execArgv ceiling. Verified locally on 4.1.11: web 28 files / 461 tests pass apps/cli 4 files / 16 tests pass apps/mcp 1 file / 2 tests pass sharded coverage gate: lines 54.05% >= 54%, functions 46.65% >= 40%, branches 44.61% >= 40% No gate weakened: no IgnoredVulns entry added, no threshold lowered, no test skipped. * fix(deps): refresh lockfile against current nself-org/packages The previous lockfile was generated against a local packages/ clone that was 12 days stale (3e6d061, 2026-08-31) while origin/main is bf33eda3 (2026-09-12). CI clones packages fresh on every run, so its package.json set did not match what the lockfile recorded and both installs died: ERR_PNPM_OUTDATED_LOCKFILE Cannot install with frozen-lockfile because pnpm-lock.yaml is not up to date with <ROOT>/packages/@nself-web/csp/package.json Regenerated against packages@bf33eda3. Verified pnpm install --frozen-lockfile now exits 0, the same invocation both CI jobs use, and web still passes 28 files / 461 tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package.json:fast-urioverride floor raised3.1.5 -> 3.1.6(resolved3.1.7), clearing alerts fix(ci): Epic G T10 — remove wiki-sync continue-on-error (wiki initialized) #43-46 (host-confusion / SSRF via IDN and IPv6/percent-decoding normalization bugs, all high).apps/mobile/package.json: adds/corrects override targets forjs-yaml(now scoped to both the 3.x and 4.x lines it actually resolves -- was only catching a 4.x floor of4.2.0),nanoid,brace-expansion(1.x + 2.x line-scoped),tar,shell-quote,postcss.Known gap -- apps/mobile/pnpm-lock.yaml NOT regenerated
apps/mobilecarries its own separatepnpm-lock.yaml, and its dependencies includeworkspace:*refs against the siblingnself-org/packagesclone. Two approaches were tried and both failed to reproduce locally what CI'smobile-testjob apparently does (pnpm install --frozen-lockfile,working-directory: apps/mobile):pnpm installfromapps/mobile-- pnpm walks up, finds the rootpnpm-workspace.yaml(apps/mobile IS a listed member), and writes to the root shared lockfile instead ofapps/mobile/pnpm-lock.yaml.pnpm install --ignore-workspace-- fails immediately:"@nself/auth-core@workspace:*" is in the dependencies but no package named "@nself/auth-core" is present in the workspace, since ignoring the workspace also drops thepackages/@nself/*clone-in resolution the app needs.The override targets above are correct and ready; someone with the exact local recipe (or CI itself, if there's a way to have it commit back) needs to actually run the install that produces
apps/mobile/pnpm-lock.yaml. Logged in.claude/phases/current/p6/residue-register.md. This leaves alerts #1-6, #9, #11-14, #20, #22-25, #27-29, #32, #34-35 open on that specific file for now.Test plan
pnpm install --no-frozen-lockfile(underheavy-lock, siblingpackages/cloned in per CI's own recipe) -- resolvedfast-uri@3.1.7pnpm install --frozen-lockfile-- exit 0pnpm-lock.yamlapps/mobile/pnpm-lock.yaml-- not regenerated, see gap aboveTicket: P6 DEPENDABOT-HIGH-SWEEP unit (nself PPI phase P6)