chore(deps): npm audit fix in website (uuid, brace-expansion, next patch)#78
Conversation
…tch) Output of `npm audit fix --legacy-peer-deps`: - uuid 11.1.0 -> 11.1.1 (fixes GHSA-w5hq-g745-h8pq buffer bounds check, dependabot alert #30) - brace-expansion 5.0.3 -> 5.0.6 and 1.1.12 -> 1.1.14 (fixes GHSA-f886-m6hf-6m8v ReDoS via zero-step sequence) - next 15.5.15 -> 15.5.18 (cascading patch bump, picked up automatically) Lockfile-only change. package.json untouched. Remaining open advisory: postcss <8.5.10 bundled inside node_modules/next/node_modules/postcss. The only fix npm proposes is downgrading next to 9.3.3 (major break) -- not applied. The XSS path requires CSS coming from untrusted user input, which is not present in our static site build pipeline. Will re-evaluate when Next.js bumps its internal postcss pin.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Deploying attestix with
|
| Latest commit: |
14b53a9
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://cf14ed0e.attestix.pages.dev |
| Branch Preview URL: | https://fix-uuid-vuln-bounds-check.attestix.pages.dev |
1 participant
Summary
Output of
npm audit fix --legacy-peer-depsinwebsite/:uuid11.1.0 → 11.1.1 - fixes GHSA-w5hq-g745-h8pq buffer bounds check (Dependabot alert chore: prepare v0.2.5 release #30)brace-expansion5.0.3 → 5.0.6 and 1.1.12 → 1.1.14 - fixes GHSA-f886-m6hf-6m8v ReDoS via zero-step sequencenext15.5.15 → 15.5.18 - cascading patch bump, picked up automaticallyLockfile-only change.
package.jsonuntouched.Remaining advisory (not fixed in this PR)
postcss< 8.5.10 bundled insidenode_modules/next/node_modules/postcss. The only fix npm proposes is downgradingnextto 9.3.3 (major break), which we are not applying. The XSS path requires CSS coming from untrusted user input, which is not present in our static-site build pipeline. Will re-evaluate when Next.js bumps its internal postcss pin or after we add apackage.jsonoverrides entry.Test plan
npm install --legacy-peer-depsfrom clean checkout produces same lockfilenpm run buildsucceeds against next 15.5.18