Bump vulnerable deps flagged by Component Governance#27757
Draft
kian-thompson wants to merge 14 commits into
Draft
Bump vulnerable deps flagged by Component Governance#27757kian-thompson wants to merge 14 commits into
kian-thompson wants to merge 14 commits into
Conversation
Address 33 Component Governance alerts by updating pnpm-workspace overrides (manifest-only; lockfile regeneration to follow): Root pnpm-workspace.yaml: - axios@<1: ^0.32.0 -> ^0.33.0 (CVE-2026-44486/87/90/92, GHSA-gcfj-64vw-6mp9) - axios@^1.15.0: 1.16.0 -> ^1.18.1 (GHSA-gcfj/jqh4/mmx7/7q8q/mwf2/f4gw/xj6q) - brace-expansion@>=5 <6: ^5.0.6 -> ^5.0.7 (CVE-2026-13149) - brace-expansion@>=1 <2: ^1.1.16 (new) (CVE-2026-13149) - brace-expansion@>=2 <3: ^2.1.2 (new) (CVE-2026-13149) - js-yaml@>=3 <4: ^3.15.0 (new) (CVE-2026-59869) - js-yaml@>=4 <5: ^4.3.0 (new) (CVE-2026-59869) - webpack@>=5 <6: ^5.104.1 (new) (CVE-2025-68157/68458) - websocket-driver@>=0 <1: ^0.7.5 (new) (CVE-2026-54466/54490) - fast-uri: ^3.1.2 -> ^4.1.1 (CVE-2026-16221) packages/test/test-version-utils/compat-workspaces/full/pnpm-workspace.yaml: - axios@<1: ^0.31.1 -> ^0.33.0 - axios@>=1 <2: ^1.15.2 -> ^1.18.1 - brace-expansion@>=1<2, >=2<3, >=5<6 (new) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Regenerated root and compat-workspaces/full lockfiles to pick up the override changes in the previous commit. Confirmed no packagefeedproxy or ms-feed-* tarball URLs were introduced. Notable resolved versions: - axios: 0.33.0 and 1.18.1 - brace-expansion: 1.1.16, 2.1.2, 5.0.7 - js-yaml: 3.15.0, 4.3.0 - webpack: 5.109.0 - websocket-driver: 0.7.5 - fast-uri: 4.1.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Address CG alerts on webpack-dev-server 4.15.2 (CVE-2025-30359, CVE-2025-30360, CVE-2026-6402, CVE-2026-9595, CVE-2026-14620, CVE-2026-14631). All patched in 5.2.6. The v4 -> v5 upgrade is drop-in for this repo: - Repo already requires node >=22 (v5 requires >=18.12) - Webpack is already ^5.94.0 (v5 requires >=5) - All 42 webpack.config.cjs files already use setupMiddlewares; none use the removed onBefore/onAfterSetupMiddleware, http2, or https:{} options. Updated 41 package.json files (examples/**, devtools-test-app) and regenerated the root lockfile; verified no packagefeedproxy/ms-feed-* tarball URLs. Smoke-tested config load with wds@5.2.6. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
morgan 1.11.0 neutralizes CR/LF in the :remote-user token, resolving the log-forging CVE affecting 1.2.0 through 1.10.1. Updated tinylicious and services-utils; regenerated server/routerlicious/pnpm-lock.yaml (verified no proxy/tarball URLs). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The alert on uuid@3.4.0 in server/routerlicious, server/gitrest, and server/historian is transitive from kafka-node@5.0.0. kafka-node declares uuid@^3.0.0 in its package.json but does not import it in any .js file (dead dependency), so overriding to the patched 11.x line is safe API-wise. Complements the existing uuid@>=7 <12 -> ^11.1.1 override in each server pnpm-workspace.yaml. Lockfiles regenerated (no proxy/tarball URLs). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
moniker (Creative Commons Attribution-NoDerivatives license) is flagged by Component Governance as a legal-compliance issue. Current source: @fluidframework/server-services-client generates names via sillyname, not moniker. The three package.json 'browser' aliases mapping 'moniker' -> generateNames.js are dead code (no source imports moniker). Fixes: - Add `moniker: "-"` override in packages/test/test-version-utils/compat-workspaces/full/pnpm-workspace.yaml to drop the transitive dep pulled in by historical published @fluidframework/server-memory-orderer@0.10xx versions. Verified moniker removed from that lockfile. - Remove the now-unused browser aliases from webpack-fluid-loader, local-driver, and memory-orderer package.json files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Restore intentional exact-pin discipline for supply-chain-sensitive packages: - axios@^1.15.0 override: ^1.18.1 -> 1.18.1 (exact) - axios@>=1<2 in compat-workspaces: ^1.18.1 -> 1.18.1 (exact) - webpack-dev-server direct dep: ^5.2.6 -> ~5.2.6 (tilde) across 41 example/tool packages The exact axios pin matches the pre-existing convention (see the axios supply-chain compromise notes and neverBuiltDependencies list in the root pnpm-workspace.yaml). Lockfiles regenerated; resolved versions unchanged (axios 1.18.1, webpack-dev-server 5.2.6). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
area: examples
Contributor
|
Hi! Thank you for opening this PR. Want me to review it? Based on the diff (12774 lines, 59 files), I've queued these reviewers:
How this works
|
webpack-dev-server@5.x .d.ts references open@10 (ESM-only), which trips TS1479 for the two packages that 'import type' from webpack-dev-server under Node16 CJS module resolution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Regenerating the lockfile with the CG-override bumps caused pnpm to resolve two puppeteer peer variants (via debug's supports-color peer: 8.1.1 and 10.2.2). That produced a nominal Page-type mismatch in the presence-tracker jest suite (TS2345, #private field mismatch). Force supports-color to ^10.2.2 so debug and its dependents dedup to a single puppeteer resolution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The supports-color override didn't dedupe puppeteer peer variants and broke chalk@3 (which requires CJS supports-color <9). After merging upstream/main (which reverted the internal registry setting), a clean lockfile regen resolves the puppeteer TS2345 issue in jest tests without needing this override. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Historical @fluidframework/server-memory-orderer@0.10xx published versions
require('moniker') at runtime (in localNode.js), so the transitive dep
cannot be dropped without breaking realsvc test loading. My earlier
assumption that moniker was dead code was incorrect for these older
published versions.
The moniker CG legal alert on those historical packages returns, but
it's isolated to the compat sub-workspace's test-time installs of older
published server-memory-orderer versions — not our shipped code.
Fixes: Error: Cannot find module 'moniker' in
test:realsvc:tinylicious:report and test:realsvc:local:report.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The webpack-dev-server 4→5 bump (needed for CG CVE fixes) introduced supports-color@10.2.2 into presence-tracker's transitive dep chain, which caused pnpm to create a new debug@4.4.3(supports-color@10.2.2) peer variant. types_jest-environment-puppeteer, which had no webpack-dev-server dep, kept resolving the older debug@4.4.3(supports-color@8.1.1) variant. That variant divergence cascaded up through jest-environment-puppeteer → puppeteer, producing two nominally-incompatible Page types: - The Page imported by presence-tracker's test resolved via the (supports-color@10.2.2) puppeteer variant. - The Page returned by the jest-environment-puppeteer 'page' global (typed via @types/jest-environment-puppeteer, which links to this workspace package) resolved via the (supports-color@8.1.1) variant. - Result: TS2345 mismatched Page in presenceTracker.test.ts. Add puppeteer, typescript, and webpack-dev-server as devDeps on the types workspace so its jest-environment-puppeteer resolution shares the same peer axis as presence-tracker's. Verified via lockfile diff that both importers now resolve jest-environment-puppeteer@10.1.4(debug@4.4.3(supports-color@10.2.2))(supports-color@10.2.2)(typescript@5.4.5) identically, and confirmed locally with presence-tracker test:jest, full ci:test:jest sweep, ci:build, and test:realsvc:local:report:full. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Root's puppeteer devDep and presence-tracker's puppeteer resolve to different pnpm peer variants (root:supports-color@8.1.1 vs presence-tracker:supports-color@10.2.2). The shim was declaring 'page: JestPuppeteerGlobal["page"]', which pulled Page transitively through jest-environment-puppeteer.d.ts's own 'import from "puppeteer"'. That import resolves at the .pnpm real path of jest-env-puppeteer, whose ancestor node_modules only contains root's (8.1.1) variant — a different real file from presence-tracker's (10.2.2) variant. TypeScript deduplicated by Package ID locally but not consistently on CI, producing TS2345 mismatched-Page errors in presenceTracker.test.ts. Importing Page directly from 'puppeteer' inside the shim resolves via types_jest-environment-puppeteer/node_modules/puppeteer (10.2.2), the identical real path as consumers, so type identity is unambiguous. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Bundle size comparisonBase commit: The PR's CI build failed — fix the build and the comment will update once the next run succeeds. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Address 42 Component Governance alerts flagged against the repo. Uses pnpm overrides (with exact pins for supply-chain-sensitive packages) for transitive deps, and direct version bumps for packages we own the specifier for.
Root
pnpm-workspace.yamloverridesaxios@<1:^0.32.0→^0.33.0(CVE-2026-44486/44487/44490/44492, GHSA-gcfj-64vw-6mp9)axios@^1.15.0:1.16.0→1.18.1(exact pin) — fixes GHSA-gcfj/jqh4/mmx7/7q8q/mwf2/f4gw/xj6q. Exact pin per the axios supply-chain compromise note in this file.brace-expansion: added>=1<2 → ^1.1.16,>=2<3 → ^2.1.2; bumped>=5<6to^5.0.7(CVE-2026-13149)js-yaml: added>=3<4 → ^3.15.0,>=4<5 → ^4.3.0(CVE-2026-59869)webpack: added>=5<6 → ^5.104.1(CVE-2025-68157, CVE-2025-68458)websocket-driver: added>=0<1 → ^0.7.5(CVE-2026-54466 Critical, CVE-2026-54490)fast-uri:^3.1.2→^4.1.1(CVE-2026-16221)Compat-workspaces overrides: matching axios/brace-expansion bumps plus
moniker: "-"to drop the legal-flagged transitive from historical published@fluidframework/server-memory-ordererversions.Server workspaces (routerlicious/gitrest/historian): added
uuid@<7 → ^11.1.1to patch CVE-2026-41907.uuidis a dead transitive ofkafka-node@5.0.0(declared but never imported), so API compat is not a concern.Direct dependency bumps
webpack-dev-server:~4.15.2→~5.2.6across 41 example/tool packages (CVE-2025-30359/30360, CVE-2026-6402/9595/14620/14631). Repo already requires node ≥22 and webpack ≥5; no config uses the removed v4-only APIs (onBefore/AfterSetupMiddleware,http2,https: {}).morgan:^1.8.1→^1.11.0intinyliciousandservices-utils(CVE-2026-5078, log forging via:remote-user).Cleanup: removed three dead
"browser": { "moniker": ... }aliases inwebpack-fluid-loader,local-driver, andmemory-orderer(no source importsmoniker; underlying@fluidframework/server-services-clientnow usessillyname).All affected lockfiles regenerated (root,
compat-workspaces/full,server/routerlicious,server/gitrest,server/historian) and verified to contain nopackagefeedproxy/ms-feed-*tarball URLs (supply-chain policy).Intentionally deferred (not in this PR)
Reviewer Guidance
The review process is outlined on this wiki page.
webpack.config.cjsfiles for v4-only removed APIs and none appear. Please double-check any dev-server configs you're familiar with.axios@^1.15.0 → 1.18.1override is an exact pin to preserve the existing supply-chain discipline in this file; do not change to a caret without discussion.moniker: "-"override in compat-workspaces relies on the fact that currentserver-services-clientusessillyname; if any back-compat published version actually invokes moniker at runtime during compat tests, the compat matrix will surface it.