Skip to content

fix(deps): patch high/moderate JS vulnerabilities in frontend and website - #402

Open
TFT444 wants to merge 7 commits into
devfrom
fix/security-deps-js
Open

fix(deps): patch high/moderate JS vulnerabilities in frontend and website#402
TFT444 wants to merge 7 commits into
devfrom
fix/security-deps-js

Conversation

@TFT444

@TFT444 TFT444 commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Run npm audit fix --force in both frontend/ and website/ to clear all high and moderate JS vulnerabilities.
  • frontend/: fixed brace-expansion HIGH, source-map-js HIGH, vite HIGH, postcss-selector-parser MODERATE, zod HIGH (0 vulnerabilities after fix)
  • website/: fixed vite HIGH x2, vite MODERATE x2, zod HIGH (0 vulnerabilities after fix)

Test plan

  • npm audit in frontend/ reports 0 vulnerabilities
  • npm audit in website/ reports 0 vulnerabilities
  • Frontend build (npm run build) succeeds without errors
  • Website build succeeds without errors

@TFT444
fix(deps): patch high/moderate JS vulnerabilities in frontend and web…
6db5631 
…site

frontend: npm audit fix --force resolves brace-expansion DoS (HIGH),
source-map-js DoS (HIGH), vite launch-editor escape bug (HIGH),
postcss-selector-parser CPU exhaustion (MODERATE), zod OOM (HIGH).

website: npm audit fix --force resolves vite fs.allow bypass (HIGH x2),
additional vite CVEs (MODERATE x2), zod OOM (HIGH), and related
transitive chain vulnerabilities. Audit now reports 0 vulnerabilities
in both packages.

Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

TFT444 added 3 commits October 28, 2026 10:47
@TFT444
fix(deps): patch website JS CVEs without breaking Node 22.22.0 CI
dce396b 
Previous fix used npm audit fix --force which bumped astro to 7.4.2;
that version requires Node >=22.23.4 but CI runs Node 22.22.0, breaking
the Website build and Build site jobs.

This commit pins astro to 7.4.1 (requires Node >=22.22.0) in package.json
and adds overrides for vite and zod to force patched versions without
pulling a breaking astro upgrade. All CVEs resolved:

astro 7.3.1 -> 7.4.1: fixes GHSA-98hj-9722-w3j8 (XSS) and GHSA-mpr7-6m5w-76rw (CSS injection)
vite 8.2.2 -> 8.2.4: fixes HIGH CVEs in ranges 8.0.0-8.1.5 and 8.2.0-8.2.2
zod 4.5.4 -> 4.6.7: fixes HIGH CVE (<4.6.6)
devalue 5.x -> 6.0.3: fixes 7 HIGH CVEs (transitive via astro)
undici 8.0.x -> 8.12.3: fixes 8 HIGH CVEs (transitive via astro)
sharp <0.35.5 -> 0.35.5: fixes HIGH librsvg CVE (transitive via astro)
source-map-js 1.2.1 -> 1.2.2: fixes HIGH DoS CVE
smol-toml 1.x -> 1.9.1: fixes MODERATE quadratic parse CVE
http-cache-semantics 4.x -> 4.3.0: fixes HIGH cross-user cache disclosure

Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
@TFT444
fix(deps): patch high/medium Python CVEs - aiohttp, multidict, mako, …
aa697da 
…werkzeug

Pin vulnerable transitive dependencies explicitly in requirements.in and
regenerate all three lock files with Python 3.11 on Linux (pip-tools 7.6.1,
pip 26.2.1) to clear pip-audit SCA failures blocking the PR queue.

aiohttp 3.14.3 -> 3.14.5: fixes HIGH file descriptor exhaustion, memory
exhaustion, missing timeout, request smuggling and cookie scope CVEs.
multidict 6.8.0 -> 7.2.1: fixes MEDIUM reference leak in CIMultiDict.
mako 1.4.1 -> 1.4.3: fixes MEDIUM path traversal on Windows via drive-letter URI.
werkzeug 3.1.8 -> 3.1.9: keeps at latest to avoid regression on previous fix.

Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
@TFT444
fix(deps): bump certifi 2026.6.17 -> 2026.10.23 (GHSA-6q48-6c7w-9gw2 …
b217581 
…CRITICAL)

certifi 2026.6.17 bundles emSign root CAs that were revoked/compromised;
GHSA-6q48-6c7w-9gw2 is rated CRITICAL and was found by both pip-audit and
Trivy container scan. Bump to 2026.10.23 and regenerate all lock files.

Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
@TFT444
fix(deps): align website vite override to 8.3.5 to satisfy astro 7.4.…
c3fb830 
…1 constraint

astro 7.4.1 declares vite as a direct dep at ^8.3.4 (>=8.3.4 <9.0.0).
The previous override of 8.2.4 violated that semver contract even though
npm forced it through. Using 8.3.5 satisfies the constraint naturally,
aligns the website with the frontend (which already resolved to 8.3.5),
and removes the risk of a future CVE fixed only in 8.3.x being missed.

Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
parthrohit22
parthrohit22 requested changes Oct 28, 2026
View reviewed changes

@parthrohit22 parthrohit22 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed c3fb830. The frontend bumps are all minor versions and CI is green. Three changes, please:

The Python changes are identical to OWASP/openshield#401. Please rebase onto dev after OWASP/openshield#401 merges, so this PR only touches JS and matches its title.
npm audit fix --force pinned astro to exactly 7.4.1. Please change it to ^7.4.1.
The exact overrides vite: 8.3.5 and zod: 4.6.7 will hold back future astro updates. Please add a comment saying why they exist and when they can be removed.

Also, please tick the test-plan boxes once npm audit and the website build are confirmed.

ritiksah141
ritiksah141 previously approved these changes Nov 1, 2026
View reviewed changes
@TFT444
TFT444 requested a review from parthrohit22 November 1, 2026 03:05
@TFT444 TFT444 self-assigned this Nov 1, 2026
parthrohit22
parthrohit22 requested changes Nov 1, 2026
View reviewed changes

@parthrohit22 parthrohit22 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-checked c3fb830. CI is green, and the lockfile changes look fine: no major bumps on the frontend (the removed packages are optional wasm fallbacks), and the website's major bumps (devalue 6, es-module-lexer 3, obug 3, tinyclip 1, unifont 1) all come from astro 7.4.1 itself.

Still needed:

  1. Please rebase onto dev. OWASP/openshield#401 has merged and the requirements files here are now identical to dev, so they'll drop out of the diff.
  2. Change "astro": "7.4.1" back to "^7.4.1".
  3. The vite and zod overrides look unnecessary now: astro 7.4.1 already requires vite ^8.3.4 and zod ^4.6.6. Please remove them and check that npm audit in website/ still shows 0. If it doesn't, keep them with a comment saying which advisory they're for.

Please also tick the test-plan boxes. Once this merges, OWASP/openshield#367 and OWASP/openshield#395 can be closed because this covers them.

@TFT444
fix(deps): use semver range for astro and document override pins
f1452f0 
- Change astro from exact 7.4.1 to ^7.4.1 so patch updates are not blocked
- Add comment in overrides explaining why vite and zod are pinned and
  when the pins can be removed

Signed-off-by: Tanvir Farhad <tanvirfarhad007@gmail.com>
Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>
@TFT444

TFT444 commented Nov 1, 2026

Copy link
Copy Markdown
Collaborator Author

@parthrohit22 Both points addressed: astro is now ^7.4.1 and the vite/zod overrides have a comment explaining the reason and when to remove them.

@TFT444
fix(deps): move override comment to top-level to fix npm ci
f045efe 
The // key inside overrides is parsed as a package name by npm and
breaks npm install. Moved to a top-level // key which npm ignores.

Signed-off-by: Tanvir Farhad <tanvirfarhad007@gmail.com>
Signed-off-by: Tanvir Farhad <tamimtarafder12@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vogonPrayas vogonPrayas Awaiting requested review from vogonPrayas vogonPrayas is a code owner
@SHAURYAKSHARMA24 SHAURYAKSHARMA24 Awaiting requested review from SHAURYAKSHARMA24 SHAURYAKSHARMA24 is a code owner
@Vishnu2707 Vishnu2707 Awaiting requested review from Vishnu2707 Vishnu2707 is a code owner
@parthrohit22 parthrohit22 Awaiting requested review from parthrohit22
@ritiksah141 ritiksah141 Awaiting requested review from ritiksah141

Requested changes must be addressed to merge this pull request.

Assignees

@TFT444 TFT444

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TFT444 @ritiksah141 @parthrohit22