fix(security): clear postcss and brace-expansion high-severity advisories - #720
fix(security): clear postcss and brace-expansion high-severity advisories#720seonghobae wants to merge 3 commits into
Conversation
…ries The security-audit gate (npm audit --workspaces --audit-level=high) failed on two high-severity advisories in dev-only transitive dependencies: - postcss 8.5.16 -> 8.5.25: GHSA-r28c-9q8g-f849, path traversal in source-map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. - brace-expansion -> 5.0.8: GHSA-3jxr-9vmj-r5cp and GHSA-mh99-v99m-4gvg, denial of service via exponential-time / unbounded expansion. Both reach the tree only through the build/test toolchain (vite, eslint), not the desktop runtime. Remediated with `npm audit fix --package-lock-only`, which bumps each within its parents' semver ranges; package.json is unchanged, so no new direct dependency is introduced and no runtime code path changes. Verification: - npm audit --workspaces --audit-level=high -> found 0 vulnerabilities - npm install --package-lock-only re-run is a no-op (lockfile in sync) - python3 scripts/checks/verify_supply_chain.py -> Supply-chain verification passed - lockfile-only change; ESLint/tsc/vitest/build gates cover code, untouched here Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8
|
Warning Review limit reached
Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthrough
Changes보안 감사 변경 기록
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
…lock The central trivy-fs filesystem scan flagged two advisories in services/analysis-engine/uv.lock that fail the security gate: - yt-dlp CVE-2026-55404 (HIGH): bumped 2026.6.9 -> 2026.7.4. - setuptools CVE-2026-59890 (MEDIUM): bumped 81.0.0 -> 83.0.0, forced via a [tool.uv] constraint-dependencies entry (the plain resolver left it at the vulnerable pin). setuptools>=83 is coupled through demucs 4.0.1 to torch>=2.13, so the lock also advances torch 2.12.1 -> 2.13.0 and cuda-toolkit 13.0.2 -> 13.0.3.0; pinning torch back makes the resolution unsatisfiable, so the ML runtime moves with the security bump. All four are minor/patch upgrades validated by the python (100% coverage) and build-baseline CI gates. Verification: - uv lock --upgrade-package setuptools --upgrade-package yt-dlp -> resolves; exactly 4 package versions change (yt-dlp, setuptools, torch, cuda-toolkit) - torch 2.13 behavior is validated by CI (local install is not feasible behind the sandbox PyPI proxy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8
The prior remediation resolved yt-dlp to the patched 2026.7.4 in uv.lock but left the pyproject floor at >=2026.6.9 — below the CVE-2026-55404 fix — so a future re-resolution could silently drift back onto a vulnerable version. Raise the direct-dependency floor to >=2026.7.4 so the constraint itself enforces the patched release (matching the setuptools>=83.0.0 remediation pattern), and regenerate uv.lock (resolution unchanged; still yt-dlp 2026.7.4, setuptools 83.0.0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8
|
Closing as closed-duplicate/superseded (security/CVE cluster) by autonomous product-completion loop. Winner / disposition target: #727 Unique value from this cluster is consolidated there (projectId path guard + npm HIGH CVE pins + Foote novelty kernel sign). Remaining micro-duplicates do not land additional commercial readiness. |
|
closed-closed-duplicate/superseded (security/CVE cluster) → #727 |
2 participants
Summary
security-auditgate (npm audit --workspaces --audit-level=high) fails ondevelopdue to two high-severity advisories in dev-only transitive dependencies:postcss8.5.16 → 8.5.25 — GHSA-r28c-9q8g-f849 (path traversal in source-map auto-loading viasourceMappingURL, arbitrary.mapdisclosure).brace-expansion→ 5.0.8 — GHSA-3jxr-9vmj-r5cp and GHSA-mh99-v99m-4gvg (DoS via exponential-time / unbounded expansion).npm audit fix --package-lock-only; each is bumped within its parents' semver ranges. Lockfile-only change (package.jsonunchanged) plus a### SecurityCHANGELOG entry.Verification
./scripts/harness/quickcheck.sh— not run locally (needs the fulluv/ Rust / vitest toolchain); CI runs it. This change is lockfile-only, so the ESLint /tsc/ vitest / build gates that cover code are unaffected.npm audit --workspaces --audit-level=high→ found 0 vulnerabilitiesnpm install --package-lock-onlyre-run is a no-op (lockfile in sync withpackage.json)python3 scripts/checks/verify_supply_chain.py→ Supply-chain verification passedSecurity Notes
Attack surface
postcssenters viavite,brace-expansionvia the lint/test tooling. Neither is on the shipped Tauri desktop runtime path. Thepostcssflaw discloses arbitrary.mapfiles during source-map auto-loading;brace-expansionis a ReDoS/OOM on adversarial brace patterns.Trust boundary
Mitigations
postcss8.5.25,brace-expansion5.0.8) within existing semver ranges, so the transitive graph is otherwise unchanged.Test points
npm audit --workspaces --audit-level=high(the gate) returns 0 high-severity findings;verify_supply_chain.pypasses.Dependency and Supply Chain
overridespin was rejected becausebrace-expansionappears at more than one major;npm audit fixpatches each within-rangei18n impact
Reviewer checklist
developGenerated by Claude Code
Summary by CodeRabbit
보안
문서