Repository navigation
fix(deps): lift follow-redirects and joi past high advisories for the audit gate - #101
Merged
Merged
Conversation
… audit gate pnpm audit --audit-level=high has failed on main since 1 Nov: follow-redirects 1.16.1 (GHSA-mrwp-f3q8-3g9p, fixed in 1.16.2) and joi 17.13.8 (GHSA-4528-x5fx-h6hg, fixed in 17.13.9). Both are reached only through wait-on, a desktop devDependency; nothing in the packaged app imports them. The overrides now resolve to the patched releases. postcss-selector-parser@6 moves to 6.1.5 as well (moderate GHSA-rj75-hqrm-r3gf, build-time via Tailwind 3); the compiled CSS is byte-identical.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the Dependency vulnerability scan, which has failed on
mainsince at least 0d5065e.Cause: two high advisories hit the lockfile:
follow-redirects1.16.1, GHSA-mrwp-f3q8-3g9p (cross-realmsensitiveHeadersarrays are discarded, so custom credentials can follow redirects). Fixed in 1.16.2.joi17.13.8, GHSA-4528-x5fx-h6hg (quadratic-time split instring().email({ multiple: true })). Fixed in 17.13.9.The
pnpm.overridesfloors are raised to^1.16.2and^17.13.9.postcss-selector-parser@6also moves from^6.1.3to^6.1.5, which clears the moderate GHSA-rj75-hqrm-r3gf.Not reachable at runtime. Both high packages come in only through
wait-on, a desktop devDependency (wait-on → axios → follow-redirectsandwait-on → joi). The lockfile marks all of them dev-only. The packaged app ships only the vite bundles plus the better-sqlite3 addon, and nothing imports axios, follow-redirects, joi or wait-on. postcss-selector-parser is build-time only, via Tailwind 3 and postcss-nested. No CHANGELOG entry, because nothing user-facing changes.Lockfile: only the three override lines and three version bumps change: follow-redirects 1.16.1→1.16.2, joi 17.13.8→17.13.9 and postcss-selector-parser 6.1.4→6.1.5. Their dependency lists are unchanged, and the integrity hashes match the npm registry.
Verification
pnpm install --frozen-lockfilepasses.pnpm audit --audit-level=highexits 0. 5 moderate advisories remain, none fixable without major bumps:^13.auditConfigdropped (CI's non-blocking full report) also shows no high.src/index.cssis byte-identical under postcss-selector-parser 6.1.5.TURBO_FORCE=true pnpm testpasses with 0 cached tasks: core 3836, storage-node 1869, desktop 10374 (13 existing skips), site 143.Follow-ups, not in this PR
pnpm.auditConfig.ignoreCves: braces (GHSA-vfj7-8cjw-p6xm) on 2026-10-23 and http-cache-semantics (GHSA-ch52-4w7c-c8xp) on 2026-10-28. Those entries and their SECURITY.md rows are now inert.wait-onis not referenced anywhere but its devDependency line. Removing it would drop axios, follow-redirects and joi from the tree.🤖 Generated with Claude Code