Repository navigation
Triage remaining development dependency audit findings #740
Description
Current status after #742 — 2026-10-12
#742, merged as 54d3c123, updated two vulnerable development-only leaf packages without changing their parent ranges:
fast-uri3.1.7 → 3.1.8 under AJV^3.0.1.nanoid3.3.16 → 3.3.20 under PostCSS^3.3.16.
Both patched versions were accepted by the repository's canonical install path, both Node test lanes, coverage, build, lint, CodeQL, and the release workflow. Release 2.0.7 was published. The generated release notes say "closes #740", but this issue remains open because other development-tool findings are unresolved.
The semantic-release/npm subtree does not currently offer a remediation:
@semantic-release/npm@13.2.0still locksnpm@11.19.1with the same affected bundled versions.- npm 11.20.0 retains those versions.
- npm 11.21.0's documented dependency change is unrelated.
- npm 12.2.0 still bundles the same affected
brace-expansion,http-cache-semantics,ip-address,undici, andpostcss-selector-parserversions.
braces@3.0.3 also remains upstream-blocked: it is still the latest release and the advisory lists no patched version.
Remaining scope
Continue tracing and remediating the remaining development-only findings when supported upstream versions exist. #739 owns the bundled npm selector-parser item. Do not add overrides, downgrades, or replacement release plumbing solely to suppress audit output.
Historical audit output before #741
During the follow-up to #739, the current resolved graph at 05ac0f262500678fb729b045967d9b44f8acc015 was audited using Node24.19.0/npm11.9.0 on 2026-10-11. Release main e6b72c68992394022b1ceb11b93b8b95d6f24738 preserves that graph; only project-version fields changed.
npm audit --package-lock-only --json returned exit1 and27 affected-package nodes, including propagated findings on parent packages. npm audit --package-lock-only --omit=dev --json returned exit0 with no findings. In addition to the three original packages in #739, the audit reported the following direct advisory nodes. Each listed installed node is marked dev: true in the lockfile.
| Package | Installed location/version | Audit severity | Advisory evidence |
|---|---|---|---|
| brace-expansion | node_modules/npm/node_modules/brace-expansion@5.0.9 |
high | GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p |
| braces | node_modules/braces@3.0.3 |
high | GHSA-vfj7-8cjw-p6xm |
| fast-uri | node_modules/fast-uri@3.1.7 |
moderate | GHSA-hrr3-gc8f-f4qj |
| http-cache-semantics | node_modules/npm/node_modules/http-cache-semantics@4.2.0 |
high | GHSA-ch52-4w7c-c8xp |
| ip-address | node_modules/npm/node_modules/ip-address@10.5.0 |
moderate | GHSA-rpw4-54j3-4h4q, GHSA-2vr4-cq9g-pvrc, GHSA-j6r3-76f7-8jcv, GHSA-h3mg-xc3c-68pw |
| js-yaml | node_modules/markdownlint-cli/node_modules/js-yaml@5.2.3 |
moderate | GHSA-r3ph-w7gj-g6xm |
| nanoid | node_modules/nanoid@3.3.16 |
high | GHSA-2v37-7h3g-55p8 |
| undici | node_modules/npm/node_modules/undici@6.28.0 |
high | GHSA-3wwx-pv8p-q78v, GHSA-r53p-7pc4-xj5r, GHSA-rfgv-xxqx-mfg5 |
Required outcome
Trace these exact installed instances to their consumers, verify the advisories' preconditions against repository tooling, and determine which supported updates remove the affected resolutions. Prefer ordinary parent/patch updates; inspect bundled npm dependencies after installation. Do not treat fixAvailable: true as proof that npm can remediate the actual graph: the separate #739 investigation reproduced a successful parent update that retained its affected bundled parser.
Apply justified fixes in a focused PR, verify the actual lock/install graph and existing lint/type/test/build/package gates, and record any external upstream blockers. Avoid forced downgrades, suppression, or new compatibility layers solely to remove audit output.
Scope and uncertainty
This issue records confirmed audit output, not an established exploit in this generator. Exposure and supported remediation for these additional packages have not yet been assessed. Parent entries in the audit must not be counted as independent vulnerabilities. #739 retains ownership of the bundled selector parser; #741 removed the KaTeX and smol-toml dependency branches. Current application CI and release2.0.6 passed, but that does not establish that development-tool advisories are resolved.
No dependency changes were published while gathering this evidence. Searches for existing open audit/security issues and the additional package names found no matching issue beyond #739.
Activity
chore(lint): replace markdownlint-cli with rumdl (#741)
fix(deps): update vulnerable development dependencies (#742)
chore(release): 2.0.7 [skip ci]