fix: resolve npm audit and composer audit vulnerabilities - #274
fix: resolve npm audit and composer audit vulnerabilities#274davidperezgar wants to merge 1 commit into
Conversation
- Bump @wordpress/scripts 19.2.4 -> 34.1.0, eliminating the bulk of transitive npm vulnerabilities (axios, postcss, nth-check, braces, cross-spawn, tar-fs, ws, js-yaml, etc.) - Add overrides for remaining vulnerable sub-dependencies pulled in by @wordpress/scripts that don't get bumped automatically: lighthouse, serialize-javascript, uuid (via sockjs), markdownlint-cli, adm-zip - npm audit now reports 0 vulnerabilities (down from 58) - Bump squizlabs/php_codesniffer 3.13.5 -> 3.13.6 to fix a high severity OS command injection (CVE-2026-67434); no composer.json change needed since it already allows ^3 - composer audit now reports 0 vulnerabilities Verified `npm run build:jfb` still builds successfully after the dependency bump.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ae429180d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }, | ||
| "overrides": { | ||
| "@wordpress/scripts": { | ||
| "lighthouse": "^13.4.1", |
There was a problem hiding this comment.
When dependencies are installed on Node 20 with engine-strict enabled, this override makes npm ci fail: the resolved Lighthouse 13.4.1 declares Node >=22.19 (package-lock.json), while its direct consumer @wordpress/e2e-test-utils-playwright declares Node >=18.12 and requests Lighthouse ^12.2.2. Either retain a compatible Lighthouse release or explicitly raise the project's Node requirement to >=22.19 so supported installation environments are not silently narrowed.
Useful? React with 👍 / 👎.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Beyond the reported lockfile/overrides sync issue, I checked whether the npm overrides nesting for uuid-via-sockjs actually reaches the vulnerable transitive copy pulled in by lighthouse/other deps (a finder had flagged this as possibly ineffective) — the override is scoped correctly under @wordpress/scripts > sockjs > uuid and would apply to that resolution path, so that concern doesn't hold up on its own; it's moot anyway since the lockfile needs to be regenerated regardless.
Extended reasoning...
One short paragraph: verified the overrides nesting itself is structurally correct (scoped under @wordpress/scripts.sockjs.uuid), so the earlier concern about it not reaching the vulnerable copy is not a real issue on its own — the blocking problem is the confirmed lockfile drift already flagged inline.
2 participants
Summary
@wordpress/scripts19.2.4→34.1.0indevDependencies, which eliminates the bulk of the npm vulnerabilities (axios, postcss, nth-check, braces, cross-spawn, tar-fs, ws, js-yaml, and more).overridesfor the vulnerable sub-dependencies still pulled in transitively by@wordpress/scripts@34.1.0that don't resolve to a patched version on their own:lighthouse,serialize-javascript,uuid(viasockjs),markdownlint-cli,adm-zip.npm auditnow reports 0 vulnerabilities (down from 58: 3 low, 32 moderate, 23 high).squizlabs/php_codesniffer3.13.5→3.13.6incomposer.lockto fix a high-severity OS command injection (CVE-2026-67434). Nocomposer.jsonchange was needed since the existing^3constraint already covers the fix.composer auditnow reports 0 vulnerabilities (down from 1 high).Test plan
npm audit→ 0 vulnerabilitiescomposer audit --locked→ 0 vulnerabilitiesnpm run build:jfbbuilds successfully with the bumped@wordpress/scriptsphpcs/phpstan/PHPUnit still run cleanly withsquizlabs/php_codesniffer@3.13.6(this sandbox could not fullycomposer installdue to GitHub API rate limiting on outbound network, but the lockfile-only update was verified viacomposer audit --locked)Generated by Claude Code