Bump vulnerable transitive deps, pin corepack, scope workflow permissions - #193
Merged
Merged
Conversation
…ssions fast-uri (SSRF/host confusion), deepmerge-ts (stack exhaustion), tmp (path traversal) and uuid (buffer bounds check) were all pulled in transitively (ajv/fastify, prisma, lhci) below their first patched version — force them via pnpm.overrides since none are direct dependencies. Trivy flagged the same fast-uri/deepmerge-ts CVEs inside the built Docker image's pruned node_modules, so this clears both. Also: pin the corepack version installed in both Dockerfiles (was unpinned), and add an explicit read-only top-level `permissions` block to generate-openapi-artifact.yml (had none, so it defaulted to the repo-wide token scope). extract-zip's symlink traversal (dependabot #37) has no upstream fix yet (latest is still the vulnerable 2.0.1) — pulled in only by @lhci/cli's Lighthouse/puppeteer chain for Chromium download during CI, not exposed to any user input, left as an accepted risk. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
github-actions
Bot
added
docker
… palette
ZAP's weekly scan hits the web/api containers directly (no Caddy in front),
which surfaced a real gap: the web app set no security headers itself,
relying entirely on Caddy's edge config — so a self-host install without
Caddy (or a custom reverse proxy missing equivalent headers) shipped
unprotected. hooks.server.ts now sets X-Frame-Options/X-Content-Type-Options
on every response either way; CSP stays out of scope (Caddy's own is still
Report-Only, a separate decision).
favicon.ico served empty Content-Type: sirv (adapter-node's static file
server) resolves MIME types via mrmime, which has no `.ico` entry. Routed
it through a +server.ts instead (favicon.ico?inline import, so the binary
stays a real file in git rather than a hand-pasted base64 blob) to set it
explicitly.
Also reworked the light theme ("le programme") palette: --accent's hue had
drifted from the dark theme's amber (33° vs 40°) and --bg was oversaturated
tan, together reading muddy/pink rather than clean paper. Realigned accent
to the same hue as dark mode's amber, lightened/desaturated bg, and
retuned success/danger/warning/stat-*/tier-silver (already correctly
hue-matched to dark mode) for AA contrast on the new bg — pa11y's
color-contrast audit was failing all of these on the landing and auth
pages. Dark theme untouched.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fast-uri,deepmerge-ts,tmpanduuidto their first patched version viapnpm.overrides(all pulled in transitively through ajv/fastify, prisma, and lhci) — fixes 12 Dependabot alerts and all 9 Trivy alerts (same CVEs, found inside the Docker image's prunednode_modules).corepackversion installed in both Dockerfiles (wasnpm install -g corepack, unpinned) — fixes 2 ScorecardPinnedDependenciesIDalerts.permissions: contents: readtogenerate-openapi-artifact.yml, which had none — fixes 1 ScorecardTokenPermissionsIDalert.pnpm-lock.yaml/pnpm-workspace.yamlre-triggers bothlint-test-apiandlint-test-webin CI, which re-uploads clean ESLint SARIF and should auto-close the 20 stale ESLint code-scanning alerts — the underlyingno-explicit-any/no-consoleviolations were already fixed in earlier commits, but CI only reruns those jobs whenapps/api/apps/webpaths change, so GitHub never got a follow-up scan to close them.Not fixed here (see conversation for the full breakdown)
extract-zipsymlink traversal): no patched version exists upstream (latest published is still the vulnerable 2.0.1). Pulled in only via@lhci/cli→ Lighthouse → puppeteer-core for downloading Chromium in CI, never touches user-controlled input. Recommend accepting the risk / dismissing the alert.TokenPermissionsIDondependabot-auto-merge.yml: already correctly scoped (workflow-levelcontents: read, job-levelcontents: write+pull-requests: writeonly for the job that actually needs to squash-merge). Scorecard flags any job-level write grant regardless of necessity — this one is required for the feature to work.Fuzzing/CIIBestPractices/CodeReview/Maintained/BranchProtection: not code fixes — respectively no fuzzing setup, no OpenSSF badge application, direct-to-main push history (0/28 "approved changesets"), repo age, andmainbranch protection settings. Branch protection is the one that's actually actionable (a GitHub repo-settings change, not code) if you want it enabled.Test plan
pnpm installsucceeds, lockfile clean, vulnerable versions gone (verified viapnpm why)pnpm build:package, API build (prisma generate+nest build), web build all succeedpnpm --filter @loomkeep/api --filter @loomkeep/shared lintandpnpm --filter @loomkeep/web lint— 0 issues (matches CI's exact commands)pre-pushhook typecheck passed🤖 Generated with Claude Code