fix(deps): patch runtime security advisories (simple-git RCE, js-yaml DoS) - #316
Merged
Conversation
Bump the two production dependencies flagged by Dependabot as runtime-scope vulnerabilities: - simple-git ^3.27.0 -> ^3.36.0 (installed 3.35.2 -> 3.36.0) fixes RCE advisory GHSA (Dependabot #6, high) - js-yaml -> ^3.15.1 via overrides (pulled transitively by gray-matter, was 3.14.2) fixes quadratic-CPU DoS via merge-key chains (Dependabot #16, high) `npm audit --omit=dev` now reports 0 vulnerabilities. Remaining open alerts are all devDependency-scoped (build/test toolchain) and do not ship in the published package.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Patches the two runtime-scope dependencies flagged by Dependabot. Both ship in the published
teamai-clipackage, so they are the ones that actually reach users.simple-git(direct)^3.27.0→^3.36.0(3.35.2 → 3.36.0)js-yaml(viagray-matter)^3.15.1viaoverrides(was 3.14.2)js-yamlis pulled transitively bygray-matter@4.0.3(declared^3.13.1), so3.15.1stays within range — anoverridesentry is enough, no fork or replacement needed.Scope
Deliberately runtime-only. The remaining open Dependabot alerts are all devDependency-scoped (vitest, postcss, vite, esbuild, brace-expansion, picomatch) — they belong to the build/test toolchain and do not ship in the published package. Those are better handled in a separate cleanup PR, and the vitest critical (#8) requires a 2.x→3.x major bump that needs its own regression pass.
Test Plan
npm audit --omit=dev→ 0 vulnerabilities (production tree clean)npx tsc --noEmit→ passesnpm run build→ successnpx vitest run→ 2182 tests / 161 files pass, no regressionssimple-git@3.36.0ops verified end-to-end: init / add / commit / log / status / branchLocaljs-yaml@3.15.1+gray-matterfrontmatter parsing verified (anchors, aliases, nested maps)