chore(deps): override transitive pins to clear npm audit findings by paustint · Pull Request #304 · jetstreamapp/soql-parser-js

paustint · 2026-10-16T13:10:38Z

Summary

Clears the open Dependabot / npm audit findings in both the root package and the docs site, using in-range lockfile bumps plus npm overrides where an upstream pin holds a vulnerable range open. No changes to the published library.

Rebased onto main (after v8.1.3) and refreshed for the advisories published since this PR was opened.

Root (`package.json`)

Finding	Cause	Fix
`undici` 7.0.0–7.30.0 (8 advisories: TLS validation bypass, cross-origin cache poisoning, several DoS)	release-it pins `undici`	lockfile bump to `7.30.1` (in range)
`basic-ftp` <=6.2.0 (GHSA-c475-qrg2-pj4r)	`get-uri` (release-it → proxy-agent → pac-proxy-agent → get-uri) wants `^5.3.1`, no patched 5.x	override `"basic-ftp@5": "^6.2.1"`
`ip-address` <=10.7.3	socks	lockfile bump (in range)

npm audit → 0 vulnerabilities. The only 6.0 breaking change in basic-ftp is that separate FTP transfer hosts are off by default, which get-uri never opts into. npm audit fix --force would have downgraded release-it to 15.10.3, which is not a real fix.

Docs (`docs/package.json`)

Finding	Cause	Fix
`minimatch` <11.0.1 (ReDoS ×3, GHSA-g3hv-75wg-m249)	`docusaurus-plugin-llms` pins `9.0.3`; g3hv has no 9.x fix	`"minimatch@9": "^11.0.1"` (the plugin uses the named `minimatch` export, which 11 keeps)
`yaml` <2.8.3	`docusaurus-plugin-llms` pins `2.8.1`	`"yaml@2": "^2.8.3"`
`uuid` <11.1.1	`sockjs` wants `^8.3.2`	`"uuid@8": "^11.1.1"`; it only calls `v4()`
`sprintf-js` (no patched release)	js-yaml 3 → `argparse@1`	`argparse` `^2.0.1`; js-yaml 3 only uses argparse in its CLI
`postcss-selector-parser` <7.1.6	cssnano 6 plugins want `^6`	`^7.1.6`
`serialize-javascript` <7.1.3 (RCE, DoS, XSS)	copy-webpack-plugin / css-minimizer-webpack-plugin want `^6`	`^7.1.3` (7.0.0 only raised Node to 20+)
`tinypool` <2.1.2 (prototype pollution → RCE)	`@docusaurus/core` wants `^1.0.2`	`^2.1.2` (2.0.0 only dropped Node 18; Docusaurus loads it via dynamic `import()`)
`joi`, `follow-redirects`, `qs`, `body-parser`, `fast-uri`	—	lockfile bumps (in range)

Overrides are keyed on the range the dependent asks for ("minimatch@9") rather than nested under a parent: a parent-scoped minimatch override got hoisted and npm deduped serve-handler's minimatch@3.1.5 onto it, which would break docusaurus serve (serve-handler calls require('minimatch') as a function). This guidance is recorded in a new Dependency overrides section of AGENTS.md.

Remaining (no patched release to move to):

minimatch 3.1.5 under serve-handler (GHSA-g3hv-75wg-m249, moderate; fixed only in 11.x, whose API serve-handler can't use). Only reachable via docusaurus serve with patterns from our own config. npm reports it once per dependent, hence 18 moderate.
deepmerge <=4.3.1 under @svgr/plugin-svgo (GHSA-gcqx-w48m-w2h4, low).

Verification

Root: clean npm ci, npm audit 0, npm run typecheck, npm run lint, npm run format:check, npm test (2370 passing), npx release-it --version
Docs: clean npm ci, npm run build (production build + CSP), docusaurus serve smoke test (/, /docs/overview, /llms.txt 200; unknown path 404), tinypool 2 worker-pool run and serialize-javascript 7 smoke tests

Copilot

🟡 Changes recommended

The docs lockfile removes serve-handler’s required minimatch version, leaving an inconsistent dependency graph.

1 open finding

Preserve serve-handler's minimatch 3.1.5 lockfile dependency · New

What changed in this PR

Adds temporary dependency overrides to address audit findings in development tooling and the docs site without changing published library code.

Changes:

Adds overrides and refreshes both lockfiles.
Records the audit improvements and remaining vulnerability.
Documents override maintenance guidance.

File	Description
package.json	Overrides `get-uri`’s `basic-ftp` dependency.
package-lock.json	Locks the updated FTP dependency.
docs/package.json	Adds docs dependency overrides.
docs/package-lock.json	Updates and deduplicates overridden dependencies.
CHANGELOG.md	Records audit remediation and remaining findings.
AGENTS.md	Documents override scope and removal guidance.

Files not reviewed (1)

docs/package-lock.json: Generated file

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🔵 Needs a closer look

Several overrides cross major versions and warrant human confirmation of tooling compatibility beyond the reported build and smoke checks.

1 open finding

Preserve serve-handler's minimatch 3.1.5 lockfile dependency

Files not reviewed (1)

docs/package-lock.json: Generated file

🧠 Review effort: Balanced

Add an `overrides` block to both package.json files for transitive dependencies whose parent asks for a vulnerable range even though a patched release exists. Root: `get-uri` (via release-it -> proxy-agent -> pac-proxy-agent) pins `basic-ftp` 5; override to 6.2.1+. Root audit is now clean. Docs: `docusaurus-plugin-llms` pins `minimatch` 9.0.3 and `yaml` 2.8.1 exactly (overridden to 9.0.7+ / 2.8.3+); `sockjs` gets `uuid` 11; `argparse` 2 drops the `sprintf-js` that js-yaml 3's CLI-only dependency pulled in; `postcss-selector-parser` 7.1.6+, `serialize-javascript` 7.0.5+ and `tinypool` 2.1.2+ replace the majors Docusaurus 3.10 still resolves. Docs audit goes from 52 findings to 29, all from the single `braces` advisory (GHSA-vfj7-8cjw-p6xm) that has no patched release. Verified: root typecheck/build/tests, release-it and get-uri still load, docs typecheck and production build.

… dependents A parent-scoped override ("docusaurus-plugin-llms": { "minimatch": ... }) leaked past its parent: once the overridden copy was hoisted, npm deduped serve-handler's minimatch@3.1.5 edge onto minimatch 9.0.9 and dropped the nested copy from the lockfile. serve-handler calls require('minimatch') as a function, which minimatch 9's CJS entry is not, so `docusaurus serve` would have thrown on its rewrite path. Keying each rule on the range the dependent asks for ("minimatch@9", "yaml@2", "uuid@8", "basic-ftp@5") only matches edges requesting that range, so serve-handler keeps its own 3.1.5 subtree. Audit results are unchanged (root 0, docs 29 from the braces advisory). Verified with a clean `npm ci` from the lockfile, the docs production build and a `docusaurus serve` smoke test. AGENTS.md guidance corrected to match.

…isories Root: npm audit fix moves release-it's undici to 7.30.1 (GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-9fm3-97px-rjf6, GHSA-xjj6-f33q-929c and others). Docs: raise the minimatch@9 override to ^11.0.1 (GHSA-g3hv-75wg-m249 has no 9.x fix; docusaurus-plugin-llms uses the named minimatch export, which 11 still provides) and serialize-javascript to ^7.1.3 (GHSA-m5mm-p8h7-m29v). In-range lockfile bumps clear joi, follow-redirects, qs, body-parser and fast-uri. serve-handler keeps minimatch 3.1.5, which has no patched release. Verified with clean npm ci in both projects, root audit 0, lint, typecheck, 2370 tests, docs production build and a docusaurus serve smoke test.

socket-security · 2026-11-01T15:35:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	release-it@21.1.1 ⏵ 21.1.2	⁺¹

View full report

Copilot

🟢 Approval recommended

The review identifies no active issues with the development and documentation dependency updates.

1 open issue

Preserve serve-handler's minimatch 3.1.5 lockfile dependency

1 file not reviewed

docs/package-lock.json: Generated file

_{Review effort: Balanced}

Copilot AI balanced review requested due to automatic review settings October 16, 2026 13:10

Copilot started reviewing on behalf of paustint October 16, 2026 13:11

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread docs/package-lock.json Resolved

Copilot AI balanced review requested due to automatic review settings October 16, 2026 13:26

Copilot started reviewing on behalf of paustint October 16, 2026 13:27

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

paustint added 3 commits November 1, 2026 08:33

paustint force-pushed the chore/npm-audit-overrides branch from 8ebea36 to e450173 Compare November 1, 2026 15:34

Copilot AI balanced review requested due to automatic review settings November 1, 2026 15:34

Copilot started reviewing on behalf of paustint November 1, 2026 15:35

View session

Copilot AI reviewed Nov 1, 2026

View reviewed changes

paustint merged commit 562cf76 into main Nov 1, 2026
10 checks passed

paustint deleted the chore/npm-audit-overrides branch November 1, 2026 15:44

Navigation Menu

Repository navigation

chore(deps): override transitive pins to clear npm audit findings - #304

chore(deps): override transitive pins to clear npm audit findings#304
paustint merged 3 commits into
mainfrom
chore/npm-audit-overrides

paustint commented Oct 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

socket-security Bot commented Nov 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

paustint commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root (package.json)

Docs (docs/package.json)

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

socket-security Bot commented Nov 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

paustint commented Oct 16, 2026 •

edited

Loading

Root (`package.json`)

Docs (`docs/package.json`)