mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-28 04:38:59 +00:00
chore(deps): bump fast-uri to 3.1.1+ to clear GHSA-q3j6-qgpj-74h6 (#1001)
GitHub published a high-severity advisory against fast-uri <= 3.1.0 (path traversal via percent-encoded dot segments, GHSA-q3j6-qgpj-74h6) which CI's npm audit step now flags. The vulnerability is not exploitable in Sencho's usage: The dependency chain is composerize@1.7.5 -> composeverter@1.7.5 -> ajv@8.18.0 -> fast-uri@3.1.0. Composerize is consumed only by POST /api/convert/ in routes/convert.ts, which parses CLI-style docker run flags (not URLs) and returns YAML. ajv's use of fast-uri is for internal JSON-Schema $ref/$id resolution, not user input. The CVE requires attacker-controlled URLs flowing into fast-uri.normalize() or equal() for path-based policy bypass; that flow does not exist in Sencho. Even though the vulnerability is not exploitable, npm audit blocks CI regardless of exploitability assessment (it does not read VEX). This commit is a lockfile-only bump produced by npm audit fix. ajv@8.18.0's range already accepts fast-uri >= 3.1.1 so no package.json change is needed. Verification: npm audit reports 0 vulnerabilities post-fix; backend test suite (1921 tests, 5 skipped) is green; tsc --noEmit is clean.
This commit is contained in:
Generated
+3
-4
@@ -10,7 +10,6 @@
|
||||
"hasInstallScript": true,
|
||||
"license": "SEE LICENSE IN LICENSE",
|
||||
"dependencies": {
|
||||
"@aws-sdk/client-s3": "3.1043.0",
|
||||
"axios": "^1.15.0",
|
||||
"bcrypt": "^6.0.0",
|
||||
"better-sqlite3": "^12.6.2",
|
||||
@@ -4906,9 +4905,9 @@
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/fast-uri": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
|
||||
"integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
|
||||
"version": "3.1.2",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
|
||||
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
|
||||
Reference in New Issue
Block a user