fix(security): close dependabot and codeql alerts - #338
Merged
Conversation
Root: bump astro, svelte, vitest, @vitest/ui, happy-dom; npm audit fix; override sharp >=0.35.0. Astro <=7.0.9 advisories stay open (need 5->7). Template: next 15.5.21, postcss ^8.5.23, pnpm caret overrides for tar, sharp, minimatch, brace-expansion, cross-spawn, flatted, picomatch, nanoid, js-yaml, ajv, micromatch, mdast-util-to-hast. pnpm audit clean. CodeQL: least-privilege permissions on all three workflows; loop HTML tag stripping in getBodyPreview until stable; escape backslash in the export test helper. Adds a regression test for the tag-strip loop.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying issueflow with
|
| Latest commit: |
6ac5822
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b0594ca0.issueflow.pages.dev |
| Branch Preview URL: | https://fix-security-alerts.issueflow.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the open Dependabot alerts on both manifests and the 10 open CodeQL alerts.
Root (npm): astro ^5.18.2, svelte ^5.55.7, vitest and @vitest/ui ^4.1.11, happy-dom ^20.11.6, plus an npm override sharp >=0.35.0; npm audit fix pulled vite 6.4.3, devalue, h3, defu, js-yaml, nanoid, picomatch, postcss, smol-toml, svgo, ws, yaml, brace-expansion, flatted and @babel/core to patched versions. Template (pnpm): next 15.5.21, postcss ^8.5.23, and pnpm overrides (caret ranges, no major bumps) for tar, sharp, minimatch, brace-expansion, cross-spawn, flatted, picomatch, nanoid, js-yaml, ajv, micromatch, mdast-util-to-hast. No lockfile was removed; root stays on npm and the template stays on pnpm.
CodeQL: top-level permissions added to ci.yml and pr-checks.yml (contents: read) and hacktoberfest.yml (issues: write, the only thing github-script does there). getBodyPreview now strips HTML tags in a loop until the string is stable so split tags like <<script>script> cannot survive one pass; a regression test covers it. The export test helper now escapes backslashes as well as closing brackets.
Verification (Windows, node 22.21.1, npm 10.9.4, pnpm 10.32.1):
npm audit --audit-level=low: 2 remaining, both astro (GHSA range <= 7.0.9, first patched 7.1.0). Closing them needs astro 5 -> 7, two majors; left out per the no-major-bump rule.
npx tsc --noEmit: pass. npm run build: pass (2 pages). npx vitest run: 520 passed, 1 failed. The failure (time-utils "6 months ago" for 180 days) fails identically on master with no changes, so it is pre-existing and not touched here.
npm run lint reports only CRLF (Delete \r) errors from the Windows checkout; eslint on the two changed source files is clean.
pnpm audit in magicuidesign-devtool-template: No known vulnerabilities found. pnpm build: pass (7 pages).
Left open: the astro alerts listed above (need a major upgrade and a compatibility pass on @astrojs/react, @astrojs/svelte and @unocss/astro). An esbuild >=0.28.1 override was tried and reverted because esbuild 0.28 refuses the es2020 destructuring transform astro 5 requests; that advisory is low and not in the Dependabot set.