chore: OSV dependency audit script + resolutions for high/critical CVEs#957
Open
EightRice wants to merge 1 commit into
Open
chore: OSV dependency audit script + resolutions for high/critical CVEs#957EightRice wants to merge 1 commit into
EightRice wants to merge 1 commit into
Conversation
✅ Deploy Preview for tezos-homebase ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
scripts/check-vulns.js— a deterministic OSV.dev-based vulnerability checker (replacesyarn audit, whose registry endpoint was retired) — and clears every HIGH/CRITICAL finding it surfaced viayarn resolutions, scoped per-consumer where a package is installed under multiple majors so unaffected majors aren't force-upgraded.New script:
yarn audit:osv(node scripts/check-vulns.js --level=high).Package changes
Reviewer callout: @coinbase/wallet-sdk
4.0.4 → 4.3.0is a same-major bump but touches runtime wallet-connection code (used bywagmi/@wagmi/connectorsfor Coinbase Wallet support). Flagging for extra review attention per the advisory (GHSA-8rgj-285w-qcq4, no public details). Build/tsc/smoke test all pass with it.path-to-regexp exception → resolved, not an exception
path-to-regexp@2.2.1(pulled in byserve-handler, via theservepackage used inyarn start) has no 2.x patch — the fix line jumps to 3.3.0. Checkedserve-handler's usage (src/index.js): it only calls the default exportpathToRegExp(path, keys)and.compile(), both of which are preserved in 3.3.0's API. Bumped it via a scoped resolution and verified directly:No functional exception needed in the end — 0 HIGH/CRITICAL findings remain.
Verification
yarn install— completes, lockfile regenerates deterministically (confirmed via repeatedyarn installruns producing identicalyarn.lock).node scripts/check-vulns.js --level=high— exit 0,35 vulnerable package version(s), 0 at or above "high". Remaining findings are all moderate/low (ajv, dompurify, qs, uuid, yaml, webpack-dev-server, postcss, etc.) — out of scope for this pass.npx tsc --noEmit— clean, no errors.yarn build(craco production build) — succeeds, only pre-existing ESLint warnings (unused vars / exhaustive-deps), no new errors.BROWSER=none PORT=3171 yarn dev, waited for compile, screenshottedhttp://localhost:3171/explorer/daoswith Playwright — header/nav (Homebase logo, search, Connect Wallet, Create DAO, All/My DAOs tabs) and footer render correctly. Dev server killed after."audit:osv": "node scripts/check-vulns.js --level=high"topackage.jsonscripts.