fix(deps): clear HIGH dependency-audit backlog (xmldom override floor) - #23
Merged
Merged
Conversation
…findings The workspace-root pnpm.overrides pin for @xmldom/xmldom was >=0.8.13, which stayed satisfied by 0.9.10 and left 11 HIGH GHSA advisories open (reachable via expo-local-authentication>expo>@expo/cli>@expo/plist). Raise the floor to >=0.9.12, the first patched release, so every resolution in the tree lands on a fixed version. No direct-dependency bump was viable here: the only path that drops xmldom without an override is jumping expo-local-authentication from its current SDK-51-era 14.0.1 to the latest 57.x line, which also forces expo-notifications and expo-secure-store to matching SDK releases -- a full native-module migration, not a dependency-audit fix. pnpm audit --audit-level=high now exits 0 (2 pre-existing ignored CVEs aside, unrelated and untouched). Verified with pnpm typecheck, pnpm build, and pnpm test --filter "@nself/*" -- all green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm.overridespin for@xmldom/xmldomwas>=0.8.13, which was still satisfied by the resolved0.9.10and left 11 HIGH-severity GHSA advisories open (xmldom, reachable viaexpo-local-authentication > expo > @expo/cli > @expo/plist).>=0.9.12, the first patched xmldom release, so every resolution in the dependency tree lands on a fixed version. This is the same override-at-workspace-root pattern already used for the rest of the entries in this block (overrides declared inside an individual package have no effect here).mainby a prior merge; this PR only adds the xmldom fix on top.expo-local-authenticationfrom its current SDK-51-era14.0.1to the latest57.x, which also forcesexpo-notificationsandexpo-secure-storeto matching SDK releases -- a full native-module migration, out of scope for a dependency-audit fix.Verification
pnpm audit --audit-level=high-> exit 0 (previously exit 1, 13 HIGH advisories at the branch point). Two pre-existing ignored CVEs inpnpm.auditConfig.ignoreCves(CVE-2025-71330, CVE-2025-71329) are untouched and unrelated to the findings fixed here.pnpm typecheck-> cleanpnpm build-> 18/18 tasks successfulpnpm test --filter "@nself/*"-> 29/29 tasks successfulRemaining, out of scope (below the HIGH gate threshold)
decode-uri-component(moderate, GHSA-vcc3-ghjq-m6fr) via the same expo/@react-navigation chainvitest/@vitest/mocker(moderate, GHSA-82fw-gwwq-j7x9) -- the existingvitest: >=3.2.6override already pins the floor; the patched release is above what's currently tagged latest, left for a follow-up since it doesn't break the audit-level=high gate.Test plan
pnpm audit --audit-level=highpnpm typecheckpnpm buildpnpm test --filter "@nself/*"