Repository navigation
Update dependencies to clear security advisories and improve stability - #2420
Merged
Merged
Conversation
Clears two critical advisories, JavaScript injection via AST type confusion in compile() and via an own-property check bypass, plus the moderate injection via unsafe inline embedding of precompiled templates. All affect 4.7.9 and earlier. handlebars renders the compare and inventory report templates in @appland/appmap. Deduped the ^4.7.7 descriptor onto 4.7.10 as well.
Clears the critical SAFE_FOR_TEMPLATES bypass (split template expressions surviving sanitization), the high IN_PLACE advisory where a hook removing a parent or sibling leaves the document inconsistent, and three low ones (IN_PLACE detached-node and rawtext-root issues, SMIL attributeName=href guard skipped under PARSER_MEDIA_TYPE). DOMPurify sanitizes rendered markdown and chat messages in @appland/components. Also dedupes mermaid's ^3.2.4 onto 3.4.17. Verified with the components unit test suite.
Moves @appland/appmap's express 5 stack onto patched versions: - proxy-addr 2.0.8 clears a critical IP spoofing advisory, where an IPv4-mapped IPv6 address matched a trusted IPv4 subnet; - body-parser 2.4.0 clears the DoS via trailing bytes after a payload (high), DoS with URL encoding (moderate) and DoS on an invalid limit value (low); - qs 6.16.1 picks up the arrayLimit and isBuffer DoS fixes. express serves the RPC and query UI servers. 5.3.0 raised its own floors on these, so bumping the parent is enough. Verified with the cli RPC integration tests.
Lockfile-only; both fixes are inside the declared ranges. - 8.2.0 -> 8.4.2 clears a high DoS via sequential optional groups and a moderate ReDoS. Reaches @appland/appmap through express 5's router, so it sits on the RPC server's routing path; - 1.8.0 -> 1.9.0 clears the backtracking-regex advisory (high). Only reaches the tree through sinon's nise, so it is test-only. The 0.1.7 copy is pinned exactly by express 4.18.2 under storybook 7 and is left for the storybook upgrade. Verified with the cli RPC integration tests.
Clears the high DoS via trailing bytes after a JSON payload, which affects body-parser 1.x below 1.20.9. @appland/appmap imports its json parser directly for the RPC server. 1.20.9 moves qs to ~6.16.0; deduping storybook 7's ^6.10.0 onto the same 6.16.1 drops the last qs 6.15.3, clearing its bracket-key comma and isBuffer DoS advisories. Verified with the cli RPC integration tests.
Clears two advisories affecting 0.33.0: a high prototype-pollution gadget in toFormData options and a moderate one in the default instance, where inherited properties could steer request config. 0.34.0 is the current head of the 0.x maintenance line. Its breaking changes (stricter TypeScript header value types, CIDR support in NO_PROXY) do not touch the single call site in remote recording's makeRequest, which sets no headers. Verified with the record unit tests and tsc.
Clears a high advisory in js-yaml 4.3.1 where maxTotalMergeKeys did not limit CPU use for empty merge sources. js-yaml 4 is a direct dependency of cli, client, navie, openapi and scanner. Also re-resolves the 3.x line (svgo 1, under vue-cli) from 3.14.1 to 3.15.2, in range, clearing its merge-key quadratic CPU, !!omap and prototype pollution advisories. Verified with the scanner and openapi test suites.
Lockfile-only; ajv 8 declares fast-uri ^3.0.1. Clears 13 advisories in fast-uri 3.1.5 (5 high): SSRF via malformed IPv6 and repeated hostnames, host confusion via skipped IDN canonicalization, percent-encoded schemes and unchecked WHATWG host canonicalization, authority injection via unvalidated ports, and smaller scheme and path normalization issues. fast-uri reaches validate, cli and scanner through ajv 8. Verified with the validate test suite.
Lockfile-only; every minimatch in the tree already accepts the fixed versions. Moves 1.1.18 -> 1.1.21, 2.1.4 -> 2.1.7 and 5.0.9 -> 5.0.12, clearing two high DoS advisories (uncontrolled recursion on nested brace groups and in parseCommaParts) and a moderate quadratic-time expansion on each of the three lines. brace-expansion is reached through minimatch and glob almost everywhere, including shipped code. Verified with the cli fingerprint, search and lib tests, and with eslint on models.
Lockfile-only; all moves are within declared ranges. Moves 5.2.3 -> 5.2.7, 6.2.2 -> 6.2.6 and 7.5.9 -> 7.5.13, clearing the high DoS on requests with many HTTP headers and the high memory exhaustion DoS from tiny fragments on each line. ws 7 reaches @appland/appmap via jayson; 5 and 6 are build-time (jsdom 11, webpack-bundle-analyzer). Also re-resolves the 8.x group, which the cli RPC server uses directly, from 8.21.3 to 8.22.0. ws 8.11.0 and 8.12.1 stay: engine.io-client and puppeteer-core 19 pin them with ~8.11.0 and an exact version. Verified with the cli RPC integration tests and the navie RPC unit tests.
Lockfile-only; @vue/cli-shared-utils declares launch-editor ^2.2.1. launch-editor 2.3.0 -> 2.14.2 clears five advisories: command injection via a crafted request (high), an fs.existsSync() bypass on Windows (high), NTLMv2 hash disclosure via UNC paths, missing % escaping in escapeCmdArgs(), and editor flag misinterpretation. It also raises shell-quote to ^1.10.0, which now resolves to 1.12.0 and clears the critical quote() command injection via a line terminator. Both are used only by the vue-cli dev server in @appland/components (open-in-editor). Smoke-checked that @vue/cli-shared-utils still loads launch-editor.
Lockfile-only; both moves are within declared ranges. - yaml 2.4.0 -> 2.9.1 clears a high stack overflow on deeply nested YAML collections. Its consumers are appmap-node and langchain 0.2, so it reaches @appland/navie and @appland/appmap at runtime; - source-map-js 1.2.1 -> 1.2.2 clears a high event-loop DoS through indexed source maps, via appmap-node. Verified by running the navie test suite under appmap-node.
Lockfile-only; both moves are within declared ranges. - socks 2.8.3 -> 2.8.10 moves to ip-address ^10.1.1, replacing ip-address 9.0.5 with 10.7.5. That clears a high advisory (leading- zero IPv4 octets decoded as decimal) and six moderate ones (Address6 XSS, isLinkLocal and isInSubnet mismatches, two quadratic parsing DoS issues). Drops jsbn and sprintf-js as a side effect; - http-cache-semantics 4.1.1 -> 4.3.0 clears a high advisory where max-stale handling could disclose cached responses across users. Both are reached only through the npm fetch stack (make-fetch-happen, socks-proxy-agent) under node-gyp and @semantic-release/npm, so they are build and release tooling. Smoke-checked that the modules load.
Lockfile-only; every fix is within its declared range. - postcss-selector-parser 6.1.2 -> 6.1.5 (tailwindcss, cssnano) clears a high quadratic-complexity DoS in flat selector parsing and a low uncontrolled-recursion DoS; - ajv 6.12.6 -> 6.15.0 (eslint 8) clears a moderate ReDoS with the $data option; - diff 4.0.2 -> 4.0.4 (ts-node) clears a low DoS in parsePatch and applyPatch; - @tootallnate/once 2.0.0 -> 2.0.1 (http-proxy-agent 5) clears a low control-flow scoping issue. All build- or test-time only. Verified with `yarn build` in components and `yarn lint` in models.
Clears a low XSS advisory in serialize-javascript below 7.1.3, where </script> was left unescaped in some outputs. Now resolves to 7.1.4. The resolution itself was added in d95ef5d for GHSA-5c6j-r48x-rmvq and forces 7.x over the 4.x/5.x/6.x ranges declared by rollup's and webpack's terser and copy plugins; this only raises its floor. Verified with `yarn build` in components.
Lockfile-only. Every express 4 consumer (storybook 7's builders, core server and cli, webpack-dev-server 3, webpack-bundle-analyzer 3) declares ^4.16.3 or later, so the whole group was free to move off 4.18.2. That re-resolves its exactly-pinned internals as well: - proxy-addr 2.0.8, deduped with express 5's copy (critical IP spoofing via IPv4-mapped IPv6); - body-parser 1.20.1 -> 1.20.9, deduped with cli's copy (two high DoS, one low); - path-to-regexp 0.1.7 -> 0.1.13 (three high ReDoS); - qs 6.11.0, cookie 0.5.0, send 0.18.0 and serve-static 1.15.0 replaced (arrayLimit DoS, out-of-bounds cookie fields, template injection XSS), plus express's own open redirect and redirect() XSS. Build-time only; express 4 backs the storybook and vue-cli dev servers. Smoke-tested storybook's resolved copy with a short-lived server covering routing, query parsing, json() and static().
Lockfile-only; every move is within its declared range. - compression 1.7.4 -> 1.8.2 (storybook core server, webpack-dev- server 3) clears a high DoS via a memory leak on premature close, and moves to on-headers 1.1.0, clearing its low header manipulation advisory; - webpack-dev-middleware 6.1.1 -> 6.1.3 (storybook's webpack5 builder) clears a high path traversal; - joi 17.6.0 -> 17.13.8 (wait-on, via start-server-and-test) clears a high quadratic regex backtracking in isoDate, plus two moderate and two low prototype-pollution and recursion issues. All dev-only. Smoke-checked that each module loads and works.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for this dependency refresh.
No open issues 🎉
What changed in this PR
This PR refreshes dependencies across the AppMap monorepo to address security advisories and improve stability, without changing application source code.
Changes:
- Updates
js-yamlacross five packages anddompurifyin components. - Upgrades CLI HTTP and templating dependencies and raises the root
serialize-javascriptresolution. - Refreshes the lockfile with corresponding direct and transitive dependency updates.
| File | Description |
|---|---|
yarn.lock |
Records updated dependency versions, dependency trees, and checksums. |
packages/scanner/package.json |
Updates js-yaml to ^4.3.2. |
packages/openapi/package.json |
Updates js-yaml to ^4.3.2. |
packages/navie/package.json |
Updates js-yaml to ^4.3.2. |
packages/components/package.json |
Updates dompurify to ^3.4.17. |
packages/client/package.json |
Updates js-yaml to ^4.3.2. |
packages/cli/package.json |
Updates Axios, body-parser, Express, Handlebars, and js-yaml. |
package.json |
Raises the serialize-javascript resolution to ^7.1.3. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates several dependencies across multiple packages to their latest patch or minor versions, focusing primarily on security and bug fixes. The most notable updates are to
js-yaml, which is upgraded in all relevant packages, and other key libraries such asaxios,express, anddompurify.Highlights
For the complete list, consult the individual commit messages.
Security and stability upgrades:
js-yamlfrom^4.3.1to^4.3.2inpackages/cli,packages/client,packages/navie,packages/openapi, andpackages/scannerto ensure the latest security patches are applied. [1] [2] [3] [4] [5]Other dependency updates in CLI:
axiosfrom^0.33.0to^0.34.0,body-parserfrom^1.20.6to^1.20.9,expressfrom^5.1.0to^5.3.0,handlebarsfrom^4.7.8to^4.7.10inpackages/cli/package.jsonfor bug fixes and improved compatibility. [1] [2]serialize-javascriptfrom^7.0.3to^7.1.3in the rootpackage.json.Other dependency updates in components:
dompurifyfrom^3.4.14to^3.4.17inpackages/components/package.jsonfor improved security.