fix(deps): security dependency bumps - #10347
Open
kwburns-kong wants to merge 22 commits into
Open
Conversation
fast-uri <3.1.5 is vulnerable to host confusion via backslash authority delimiters and failed IDN canonicalization (GHSA advisories), which can enable SSRF. ajv and @rjsf/utils already permit fast-uri ^3.x, so this only required refreshing the lockfile resolution, no parent bump needed.
undici <7.29.0 is affected by several advisories: Set-Cookie SameSite downgrade via permissive substring matching, cross-user cache leakage via whitespace bypass, downstream response desync via retry interceptor, CRLF injection via blob-like body 'type', and cookie attribute injection via unsanitized domain fields. The direct dependency's existing ^7.25.0 range already permitted the fix, so this only required refreshing the lockfile resolution. Note: @connectrpc/connect-node@1.7.0 still bundles its own pinned undici@^5.28.4 (resolves to 5.29.0), which remains vulnerable to the older <6.24.0 advisories. Fixing that requires a major bump of connect-node to 2.x, which needs its own review for breaking API changes - tracked as a follow-up.
…bility builder-util-runtime <9.7.0 leaks PRIVATE-TOKEN and mixed-case Authorization credentials on cross-origin redirects during electron-updater's auto-update flow. electron-builder and electron-builder-squirrel-windows pinned it exactly at 9.5.1, so those parents needed bumping (26.8.1 -> 26.15.7) to pull the fix. electron-updater's existing ^6.6.2 range already permitted 6.8.9, which resolves the same fixed builder-util-runtime.
liquidjs <=10.27.0's pop filter bypasses the memoryLimit accounting enforced by its array-filter siblings, allowing a DoS via unbounded memory growth in template rendering. Both consumers already declare ^10.27.0, which permits the fix, so this only required a lockfile refresh (resolved to 10.28.0).
ip-address <=10.3.0 decodes Address4 leading-zero octets as decimal while WHATWG URL host parsing, inet_aton, and getaddrinfo decode them as octal, letting an attacker bypass IP-based trust boundaries and achieve SSRF. express-rate-limit@8.3.2 pinned ip-address at an exact 10.1.0, so it needed bumping to 8.6.2 (still within @modelcontextprotocol/sdk's ^8.2.1 range) which declares ip-address ^10.2.0 and resolves to 10.4.0.
tar <=7.5.20 has multiple issues: process crash via PAX numeric path type confusion, decompression/parse DoS via unlimited input, infinite loop on negative entry size during archive replace, uncaught exception via NUL bytes in PAX path/linkpath records, and uncontrolled recursion in mapHas/filesFilter enabling stack-overflow DoS via crafted long-path entries. node-gyp and @mapbox/node-pre-gyp already declare tar ^7.5.4 / ^7.4.0, which permit the fix, so this only required a lockfile refresh (resolved to 7.5.22).
ws 8.0.0-8.20.1 bounds retained WebSocket message fragments via maxFragments/maxBufferedChunks, but the defaults were set too high, letting an attacker exhaust memory with many tiny fragments/chunks. The direct ws dependency's ^8.18.1 range already permitted the fix; socket.io/socket.io-client's bundled engine.io, engine.io-client, and socket.io-adapter pinned ws with a `~8.20.1` tilde range that excluded it, so those three needed bumping to pull in `~8.21.0` (still within socket.io@4.8.3's own ~6.6.0/~6.6.1 ranges). All ws instances now resolve to 8.21.2.
hono <=4.12.33 accumulates a long list of fixes: cookie name validation bypass on write/read paths, path traversal in toSSG() and serve-static (including Windows backslash encoding), IP restriction bypass for IPv4-mapped/non-canonical IPv6, JWT NumericDate/Bearer-scheme validation gaps, cache middleware Vary header leakage, CORS wildcard credential reflection, JSX SSR XSS via cx(), and a ReDoS in CORS's Access-Control-Request-Headers handling, among others. @modelcontextprotocol/sdk's existing ^1.17.5 range already permits the fix; bumping it to 1.30.0 resolves hono to 4.13.0.
valibot <=1.4.1's flatten() helper throws a TypeError when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. @react-router/dev's existing ^1.2.0 range already permits the fix, so this only required a lockfile refresh.
Direct dependency's existing ^3.4.10 range already permitted the fix; this only required a lockfile refresh.
@react-router/serve@7.15.0's existing ^1.10.1 range already permitted the fix, so this only required a lockfile refresh. Brings on-finished along from ~2.3.0 to ~2.4.1 as a nested dependency bump.
uuid <11.1.1 is missing a buffer bounds check in v3/v5/v6 when a buf is provided, which can lead to memory corruption. insomnia-data, insomnia-scripting-environment, and insomnia-smoke-test were still on ^9.0.1 (packages/insomnia already used ^11.1.1). This is a major version bump, but the only APIs in use across these packages are v4() and validate(), whose signatures are unchanged between v9 and v11, so no code changes were needed. All three now resolve to uuid@11.1.1.
csv-parse 6.x is flagged for update to 7.0.2. This is a major version bump (ESM/CJS dual-package modernization), but the sync `parse()` API that packages/insomnia-scripting-environment and the sandbox's require-interceptor (exposing it to user scripts as 'csv-parse/lib/sync') both rely on is unchanged - verified with an identical before/after parse() smoke test. No code changes needed.
…dvisories react-router 6.0.0-7.18.0 accumulates several advisories: CSRF via PUT/PATCH/DELETE document requests, open redirect via backslash in <Link>/useNavigate, RSCErrorHandler missing protocol validation (XSS), arbitrary constructor injection via deserializeErrors() in SSR hydration, and unauthenticated DoS via inefficient route matching. react-router, @react-router/dev, @react-router/fs-routes, @react-router/node, and @react-router/serve were all exact-pinned at 7.15.0 and needed bumping together (they're a version-locked family) to 7.18.2 - a non-major fix version per npm audit. One additional react-router advisory (RSC Mode CSRF Bypass, fixed only in 8.3.0+) doesn't apply here: this app doesn't use React Server Components (no react-server-dom-webpack/@vitejs/plugin-rsc usage in the codebase), so the RSC-specific code path is never exercised. As a side effect, @react-router/serve's bundled express moved from 4.22.1 to 4.22.2, which also fixes a body-parser DoS advisory (silently-disabled size limit on invalid `limit` values) for that one instance. Two other body-parser instances (smoke-test's own express, and the MCP SDK's bundled express) remain on vulnerable body-parser versions - tracked as a follow-up.
…ustion socket.io-parser 4.0.0-4.2.6 lets a specially crafted packet make the server wait for a large number of binary attachments and buffer them, exhausting memory. socket.io@4.8.3's existing ~4.2.4 range already permitted the fix, so this only required a lockfile refresh.
…-bypass DoS body-parser <1.20.6 silently disables its size-limit enforcement when given an invalid `limit` value, allowing a DoS via unbounded request bodies. insomnia-smoke-test's express (^4.21.2) already permitted the fix; bumping it to 4.22.2 resolves body-parser to 1.20.6. Note: @modelcontextprotocol/sdk still bundles express@5.2.1 with a vulnerable body-parser@2.2.2 (needs >=2.3.0). Left unfixed for now - Insomnia only uses the SDK's client-side StreamableHTTPClientTransport (packages/insomnia/src/main/mcp/transport-streamable-http.ts), never the SDK's server/express code path, so this instance is unreachable in practice. A prior attempt to patch it via manual lockfile surgery left package-lock.json in an inconsistent state (a resolved package missing its "packages" entry, so `npm ci` wouldn't reproduce it) and was reverted. Tracked as a follow-up to fix through a supported mechanism (e.g. once @modelcontextprotocol/sdk relaxes its body-parser range, or via a clean full lockfile regeneration reviewed on its own).
form-data <2.5.6 and >=4.0.0 <4.0.6 are vulnerable to CRLF injection via unescaped multipart field names/filenames. @types/request's ^2.5.5 and jsdom's ^4.0.0 ranges already permitted the fix, resolving to 2.5.6 and 4.0.6 respectively via lockfile refresh. Note: httpsnippet@3.0.10 (the latest available release) exactly pins form-data at 4.0.4, which stays vulnerable. There's no newer httpsnippet version to bump to yet - this is upstream-blocked, not fixable without an override. Tracked as a follow-up to revisit once httpsnippet ships a fix.
…cookie + uuid Bumps the pinned ^0.3.9 to ^0.5.9. This single bump fixes two findings that were previously nested inside this analytics SDK and not independently reachable: - js-cookie: was exactly pinned at 3.0.1 (<=3.0.5 is vulnerable to a per-instance prototype hijack in assign() enabling cookie-attribute injection); now ^3.0.7, resolving to 3.0.8. - uuid: customerio-gist-web bundled uuid@^8.3.2 (missing buffer bounds check in v3/v5/v6, <11.1.1); now declares ^14.0.0, resolving to 14.0.1. This was the residual instance noted as a follow-up in the earlier uuid v9->v11 commit. The AnalyticsBrowser API surface used in use-cio.tsx (load/track/ identify/page/reset) is unchanged between 0.3.19 and 0.5.9.
Fixes the remaining body-parser instance (via @modelcontextprotocol/sdk's express@5.2.1, which declares ^2.2.1 - already permitted the fix). This is the instance noted as unreachable/deferred in the prior body-parser commit; the dependency graph has since shifted (from the react-router and customerio bumps) enough that a plain `npm update body-parser` now resolves it cleanly via a proper lockfile entry, unlike the earlier attempt that left a broken lockfile via manual surgery. All three body-parser instances are now fixed.
✅ Circular References ReportGenerated at: 2026-08-07T15:46:18.923Z Summary
Click to view all circular references in PR (9)Click to view all circular references in base branch (9)Analysis✅ No Change: This PR does not introduce or remove any circular references. This report was generated automatically by comparing against the |
kwburns-kong
enabled auto-merge (squash)
August 7, 2026 17:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
This PR resolves multiple security issues found within multiple dependencies.