Patch transitive dependency vulnerabilities via npm overrides - #15
Closed
jhamon wants to merge 1 commit into
Closed
Conversation
Adds an `overrides` block pinning patched versions of vulnerable transitive dependencies. No source changes; build and all 14 tests pass, and danfojs-node (tfjs-node) + sharp load and run at runtime. npm audit: 46 -> 28 vulnerabilities (critical 4->2, high 20->11, moderate 19->12). Notable fixes: - form-data 2.3.3/3.0.1 -> 4.0.6 (critical: unsafe random boundary, CRLF injection) - protobufjs 6.11.3 -> 6.11.6 (critical: prototype pollution / arbitrary code execution in the 6.11.x line) - sharp 0.32.1 -> 0.32.6 (high: libwebp CVE-2023-4863) - tar 4.4.19/6.1.15 -> 6.2.1, semver -> 7.x, ws -> 7.5.11, plus qs, micromatch, braces, cross-spawn, minimatch, picomatch, word-wrap, brace-expansion, tar-fs, @babel/runtime, js-yaml, flatted, yaml, @protobufjs/utf8 ReDoS / prototype-pollution fixes Deliberately left for follow-up PRs (no safe in-range fix): - protobufjs / onnxruntime-web / onnx-proto critical: only reachable via the browser ONNX backend, which this Node CLI never executes; no fix on the 6.x line and forcing 7.x risks the pinned backend. - vitest critical + vite/rollup/esbuild: dev-only; needs a vitest v3 major upgrade. - xlsx / request / lodash cluster: pulled in by danfojs-node for CSV parsing; xlsx and lodash have no published npm fix. Best addressed by dropping danfojs-node (used only for trivial CSV work). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The repo has ~69 open Dependabot alerts, essentially all in transitive dependencies pulled in by three heavyweight direct deps (
@xenova/transformers,danfojs-node, andvitest). This PR takes the low-risk, high-coverage first pass: an npmoverridesblock pinning patched versions of the vulnerable transitive packages.No source changes. Build succeeds, all 14 tests pass, and
danfojs-node(tfjs-node native) +sharpload and execute at runtime after the bumps.Result
npm audit: 46 → 28 vulnerabilities.Notable fixes
form-data2.3.3/3.0.1 → 4.0.6 — critical: unsafe random boundary + CRLF injectionprotobufjs6.11.3 → 6.11.6 — critical: prototype pollution / arbitrary code execution (6.11.x line)sharp0.32.1 → 0.32.6 — high: libwebp CVE-2023-4863tar→ 6.2.1,semver→ 7.x,ws→ 7.5.11, plusqs,micromatch,braces,cross-spawn,minimatch,picomatch,word-wrap,brace-expansion,tar-fs,@babel/runtime,js-yaml,flatted,yaml,@protobufjs/utf8— assorted ReDoS / prototype-pollution fixesDeliberately left for follow-up (no safe in-range fix)
protobufjs/onnxruntime-web/onnx-protocritical — reachable only via the browser ONNX backend, which this Node CLI never executes (embeddings run throughonnxruntime-node). No fix on the 6.x line, and forcing 7.x risks the version pinned by@xenova/transformers.vitestcritical +vite/rollup/esbuild— dev-only (Vitest UI server); needs avitestv3 major upgrade.xlsx/request/lodashcluster — pulled in bydanfojs-node, used only for trivial CSV parsing.xlsx(SheetJS) andlodash4.17.21 have no published npm fix. Best addressed by droppingdanfojs-nodeand inlining the small CSV piece we use (matches the pattern of Bump @pinecone-database to v2.0.0 #6).Verification
npm install— cleannpm run build— successnpm test— 14/14 passdanfojs-nodeDataFrame ops +sharpPNG encode both work🤖 Generated with Claude Code