Security - Fix npm audit vulnerabilities #45
Conversation
Reduce audit findings from multiple high/moderate/low to only 3 low-severity storybook-related issues (elliptic, webpack) that are unfixable upstream. Direct dependency bumps: - @qdrant/js-client-rest ^1.16.0 -> ^1.16.2 - @workos-inc/node ^7.72.2 -> ^8.0.0 - diff ^8.0.2 -> ^8.0.3 (cloudflare-app-builder) - vitest ^2.1.8 -> ^3.2.4, wrangler ^4.51.0/^4.61.0 -> ^4.61.1 (cloud-agent*) - @cloudflare/vitest-pool-workers ^0.11.1 -> ^0.12.8 (cloud-agent-next) Overrides added for transitive vulnerabilities where upstream hasn't updated: - glob >=13.0.1, esbuild >=0.25.0, lodash >=4.17.23, diff >=8.0.3, fast-xml-parser >=5.3.4, vite >=6.4.1, qs >=6.14.1 Added glob@13.0.1 + minimatch@10.1.2 + @isaacs/brace-expansion@5.0.1 to minimumReleaseAgeExclude to fix GHSA-7h2j-956f-4vf2.
![kiloconnect[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| "@vercel/functions": "^3.3.3", | ||
| "@vercel/otel": "^2.1.0", | ||
| "@workos-inc/node": "^7.72.2", | ||
| "@workos-inc/node": "^8.0.0", |
There was a problem hiding this comment.
WARNING: Major version bump for @workos-inc/node (v7 → v8) may be breaking
This PR upgrades @workos-inc/node to a new major version. Please verify all WorkOS usages still match the v8 API (client initialization, method names/return shapes, and any webhook/auth helpers) and that runtime behavior is unchanged.
| "storybook": "^9.1.17", | ||
| "next": "^15.5.10", | ||
| "preact": "10.28.3" | ||
| "preact": "10.28.3", |
There was a problem hiding this comment.
WARNING: pnpm.overrides uses open-ended >= ranges
Overrides like glob: '>=13.0.1' / vite: '>=6.4.1' can silently move to newer major versions the next time the lockfile is regenerated, which can introduce unexpected breakages. Consider pinning to the minimum fixed versions (or a bounded range) to keep installs reproducible.
Code Review SummaryStatus: 2 Issues Found | Recommendation: Address before merge Overview
Fix these issues in Kilo Cloud Issue Details (click to expand)WARNING
Files Reviewed (5 files)
|
1 participant
Summary
@qdrant/js-client-rest,@workos-inc/node,diff,vitest,wrangler,@cloudflare/vitest-pool-workersglob,esbuild,lodash,diff,fast-xml-parser,vite,qsglob@13.0.1,minimatch@10.1.2,@isaacs/brace-expansion@5.0.1tominimumReleaseAgeExcludeto fix the high-severity GHSA-7h2j-956f-4vf2Audit results
Before: 19 vulnerabilities reported by GitHub (5 high, 7 moderate, 7 low)
After: 3 low-severity findings remaining, all from storybook's
webpackandelliptic— unfixable until storybook updates its dependenciesNote
The
fast-xml-parseroverride can be removed once@aws-sdk/client-s3@>=3.982.0passes the 4-dayminimumReleaseAgethreshold (the fix shipped in@aws-sdk/xml-builder@3.972.4).