fix(deps): resolve production security audit findings - #2077
fix(deps): resolve production security audit findings#2077Eli Bosley (elibosley) wants to merge 1 commit into
Conversation
Update vulnerable direct and transitive dependencies without adding audit exclusions. Keep Tiptap peers aligned and replace the vulnerable Stylus decoder chain through its parent. Work intent: dependency audit follow-up from PR #2076. Production audit now reports zero advisories. API, web, and UI builds and API/web type checks pass.
|
Warning Review limit reachedNext included review available in 20 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2077 +/- ##
==========================================
+ Coverage 53.33% 53.36% +0.02%
==========================================
Files 1043 1043
Lines 72664 72664
Branches 8387 8390 +3
==========================================
+ Hits 38758 38774 +16
+ Misses 33779 33763 -16
Partials 127 127 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
This plugin has been deployed to Cloudflare R2 and is available for testing. |
1 participant
Summary
Update production dependencies to clear the security audit: 31 advisories before the change, zero afterward, with no added audit exclusions.
Why This Exists
Work intent: resolve the failed dependency audit found while reviewing the path-traversal fix. This PR is independent of that fix and targets the dependency findings in the failing audit run.
Resolution
Update Fastify, Undici, and DOMPurify in their workspace manifests. Update the existing security overrides and add scoped overrides for vulnerable transitive versions. Refresh the Tiptap package family together in the lockfile so its exact-version peers remain aligned.
Reviewer Considerations
y-tiptap3.0.7 peer explicitly in the web package.decode-uri-componentdependency chain. Overriding the decoder directly would force an ESM package into an older CommonJS caller.Implementation Summary
Patched versions include Fastify 5.12.1, Undici 7.29.0, DOMPurify 3.4.13, fast-uri 3.1.6, PostCSS 8.5.23, qs 6.16.0, tar 7.5.21, js-yaml 4.3.1, find-my-way 9.7.0, ip-address 10.3.1, nanoid 3.3.18, and the supported brace-expansion release lines. Tiptap resolves to 3.31.3.
Verification
Node 22.18.0 and pnpm 10.15.0:
pnpm run audit --prod: zero advisories, down from 17 high and 14 moderate.type-check: passed.build: passed.TZ=UTC pnpm --filter ./web test --maxWorkers=4 --minWorkers=1: 672 passed, 6 skipped.pnpm --filter @unraid/ui test --run --maxWorkers=4 --minWorkers=1: 18 passed.pnpm --filter @unraid/shared test --maxWorkers=2 --minWorkers=1: 197 passed.pnpm --filter unraid-api-plugin-connect test --run --maxWorkers=2 --minWorkers=1: 119 passed.pnpm --filter ./api test --maxWorkers=4 --minWorkers=1: 2,155 passed; the VM suite cannot initialize without native libvirt, and one OIDC integration test times out against localhost:8080. The same OIDC timeout was reproduced with the original dependency tree.git diff --check: passed.Risk and Limits
Transitive routing, parsing, and editor packages changed. Builds, type checks, and test suites cover compatibility, but local VM integration coverage remains unavailable. No server was deployed, and this PR does not merge or release the updates.