Update browserslist to clear a high severity advisory - #10
Merged
Conversation
`npm audit --audit-level=high` began failing on a advisory published after the last release, with nothing in this repository having changed. That step runs in the `verify` job, and `verify` is a required status check on `main` with an empty bypass list, so this blocked every pull request from merging. browserslist <= 4.28.6 carries two advisories: - GHSA-c83g-rgw3-j3cx, unbounded memory growth with no cache eviction, leading to eventual OOM - GHSA-73wf-gq98-2v4g, crash or prototype write via an untrusted browserslist-stats.json Neither is reachable here. browserslist is a development-only transitive dependency five levels down the lint toolchain, by way of eslint-config-next -> eslint-plugin-react-hooks -> @babel/core -> @babel/helper-compilation-targets. It never reaches the shipped bundle. Both advisories need attacker controlled input, either a caller issuing many distinct queries or an untrusted stats file, and neither path exists in this project: Babel invokes it during lint against the repository's own configuration. So this is a CI unblock rather than a response to exploitable risk, and it is worth being clear about which of the two it is. Lockfile only. The advisory range is satisfied by a version the existing constraints already admit, so no package.json change and no constraint to relax. The change resolves to six version updates, all within the browserslist chain and its data packages: browserslist itself, plus baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases and update-browserslist-db. It also adds six packages, all of them optional and development only, nested under @tailwindcss/oxide-wasm32-wasi: the @emnapi and @napi-rs WASM runtime fallbacks for Tailwind's native engine. These are platform variants npm filled in while re-resolving. They are not installed on this platform and do not reach production. Confirmed they introduce no install scripts: `npm run check:install-scripts` still reports the same two allowlisted dev-only entries, fsevents and unrs-resolver, and nothing else. Verified on a clean `npm ci --ignore-scripts` install from the new lockfile: `npm audit --audit-level=high` exits 0, lint clean, 155 tests pass, palette checks pass, production build succeeds with all 19 routes generated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7eMcH6kHFssQ2Pxt7MnQx
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm audit --audit-level=highbegan failing on an advisory published after the last release, with nothing in this repository having changed. That step runs in theverifyjob, andverifyis a required status check onmainwith an empty bypass list — so this blocked every pull request from merging, including this one until it lands.The advisory
browserslist <= 4.28.6carries two:browserslist-stats.jsonNeither is reachable here
browserslistis a development-only transitive dependency, five levels down the lint toolchain:It never reaches the shipped bundle. Both advisories need attacker-controlled input — a caller issuing many distinct queries, or an untrusted stats file — and neither path exists in this project. Babel invokes it during lint, against the repository's own configuration.
This is a CI unblock rather than a response to exploitable risk, and it is worth being clear about which of the two it is.
What changed
Lockfile only. The advisory range is satisfied by a version the existing constraints already admit, so there is no
package.jsonchange and no constraint to relax.Six version updates, all within the
browserslistchain and its data packages:browserslistbaseline-browser-mappingcaniuse-liteelectron-to-chromiumnode-releasesupdate-browserslist-dbSix additions, all
optional: trueanddev: true, nested under@tailwindcss/oxide-wasm32-wasi— the@emnapiand@napi-rsWASM runtime fallbacks for Tailwind's native engine. These are platform variants npm filled in while re-resolving. They are not installed on this platform and do not reach production.Nothing removed.
The additions are the part worth checking rather than waving through, since new packages are exactly where an install script would arrive unnoticed.
npm run check:install-scriptsstill reports the same two allowlisted dev-only entries,fseventsandunrs-resolver, and nothing else.Verification
On a clean
npm ci --ignore-scriptsinstall from the new lockfile:npm audit --audit-level=highnpm run lintnpm testnpm run palettenpm run build🤖 Generated with Claude Code
https://claude.ai/code/session_01V7eMcH6kHFssQ2Pxt7MnQx
Generated by Claude Code