Skip to content

fix(security): remediate Zip Slip vulnerability and update dependency… - #266

Merged
rakesh-talanki merged 1 commit into
masterfrom
fix/security-remediations
Aug 7, 2026
Merged

fix(security): remediate Zip Slip vulnerability and update dependency…#266
rakesh-talanki merged 1 commit into
masterfrom
fix/security-remediations

Conversation

@rakesh-talanki

Copy link
Copy Markdown
Collaborator

… overrides

  • Add strict directory boundary validation in unzipProxy (lib/deploycommon.js) to prevent Zip Slip directory traversal (CWE-22)
  • Add automated unit test in test/testzip.js to verify Zip Slip prevention
  • Upgrade tar-fs to ^2.1.4 to fix symlink validation bypass and path traversal
  • Move body-parser from dependencies to devDependencies to reduce production bundle attack surface
  • Replace lodash.find with native Array.prototype.find in testzip.js
  • Configure npm overrides for path-to-regexp, brace-expansion, serialize-javascript, picomatch, minimatch, js-yaml, qs, cookie, diff, ajv, uuid, and node-emoji
  • Result: 0 npm audit vulnerabilities (down from 17); all 92 specs pass

… overrides

- Add strict directory boundary validation in unzipProxy (lib/deploycommon.js) to prevent Zip Slip directory traversal (CWE-22)
- Add automated unit test in test/testzip.js to verify Zip Slip prevention
- Upgrade tar-fs to ^2.1.4 to fix symlink validation bypass and path traversal
- Move body-parser from dependencies to devDependencies to reduce production bundle attack surface
- Replace lodash.find with native Array.prototype.find in testzip.js
- Configure npm overrides for path-to-regexp, brace-expansion, serialize-javascript, picomatch, minimatch, js-yaml, qs, cookie, diff, ajv, uuid, and node-emoji
- Result: 0 npm audit vulnerabilities (down from 17); all 92 specs pass
@rakesh-talanki
rakesh-talanki merged commit 6f343f7 into master Aug 7, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant