fix: clear the high-severity advisories blocking npm audit - #450
Merged
Conversation
`npm run ci` has been failing at `audit:production` since advisories landed
for two transitive production dependencies after v0.8.7 was released:
fast-uri 3.1.4 high host confusion via backslash authority introducer
GHSA-7p8r-x3mc-p8w7
ip-address 10.2.0 high leading-zero octets decoded as decimal, CIDR suffix
suppressing special-use classification, and
IPv4-mapped/NAT64 misclassification - each able to
bypass an SSRF or trust-boundary check
GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh,
GHSA-22jq-vg5j-6vgg
hono 4.12.31 (moderate, ReDoS in CORS middleware, GHSA-8j4g-w8fx-2239) is
below the --audit-level=high gate but is bumped in the same pass rather than
left as the only known advisory in the tree.
All three are patchable inside the ranges their parents already declare, so
no manifest changes: ajv wants fast-uri ^3.0.1 and 3.1.5 is the patched 3.x;
express-rate-limit wants ip-address ^10.2.0; @hono/node-server and the MCP
SDK want hono ^4 and ^4.11.4. All three are dependency-free leaves, so only
version, resolved and integrity move.
The lockfile was patched in place rather than regenerated. Running npm
install on Windows drops the optional @emnapi/* entries that npm ci needs on
the Linux runner, which has broken CI three times before. The @emnapi entry
count is 28 before and after, the diff is nine lines across exactly three
entries, and npm ci then resolves the tree cleanly.
Verified: npm ci clean, `npm audit --omit=dev --audit-level=high` reports 0
vulnerabilities, and the full `npm run ci` passes end to end.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm run cihas been failing ataudit:productiononmainand on every open branch. The advisories landed after v0.8.7 shipped, so nothing in the code caused it and no branch can go green until this merges.fast-uriip-addresshonohonois below the--audit-level=highgate, but it is bumped here rather than left as the only known advisory in the tree.No manifest changes
All three are patchable inside the ranges their parents already declare:
ajv→fast-uri ^3.0.1; 3.1.5 is the patched 3.x (4.x would not satisfy the range)express-rate-limit→ip-address ^10.2.0; 10.4.0 is patched@hono/node-server→hono ^4,@modelcontextprotocol/sdk→hono ^4.11.4; 4.13.0 is patchedAll three are dependency-free leaves, so only
version,resolvedandintegritymove.The lockfile was patched in place, not regenerated
Running
npm installon Windows drops the optional@emnapi/*entries thatnpm cirequires on the Linux runner — that has broken CI three times on this repo. So the three entries were rewritten textually instead:@emnapientry count: 28 before, 28 afternpm cithen resolves the whole tree cleanlyVerification
npm ci— clean, "found 0 vulnerabilities"npm audit --omit=dev --audit-level=high— exit 0, 0 vulnerabilitiesnpm run ci— passes end to end, through typecheck, tests, lint, build, action metadata, server manifest, action bundle drift, smoke, evaluate, and benchmark:checkMerging this unblocks #449, which is red for this reason and no other.
🤖 Generated with Claude Code