fix(deps): Clear the browser SDK's dev-dependency advisories - #142
Merged
Conversation
postcss <= 8.5.17 auto-loads a previous source map from a sourceMappingURL comment without constraining the path, so a crafted stylesheet can read an arbitrary .map file off the build machine (GHSA-r28c-9q8g-f849, high). postcss is a transitive development dependency of tsup and of vite (via vitest), pinned at 8.5.16 in the lockfile. Every dependent range (>=8.0.9, ^8.4.12, ^8.5.16) already admits the patched line, so `npm update postcss` resolves it as a lockfile-only change — no overrides pin and no package.json edit needed. Carries postcss's own nanoid dependency from 3.3.12 to 3.3.16. Verified: 10 test files / 103 tests pass and `npm run build` (tsup ESM + CJS + d.ts) succeeds on the updated tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three more advisories against the browser SDK's development tree, all transitive and none reachable from published output: - brace-expansion (high, DoS via unbounded expansion): 5.0.7 -> 5.0.8, resolved in-range by `npm audit fix`. - qs (moderate, GHSA-q8mj-m7cp-5q26 — qs.stringify crashes on null entries in comma-format arrays when encodeValuesOnly is set): reached through @stryker-mutator/core -> typed-rest-client. typed-rest-client pins qs at an exact 6.15.1 (its latest 3.0.0 still does), so audit fix cannot move it — add a `qs: ^6.15.2` override alongside the existing esbuild one, which resolves 6.15.3 and carries side-channel 1.1.0 -> 1.1.1. Drop the override once typed-rest-client picks up a patched qs. `npm audit` is now clean. Verified on a clean `npm ci`: 10 test files / 103 tests pass, tsup builds ESM + CJS + d.ts, and Stryker still resolves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
wolpert
enabled auto-merge (rebase)
July 29, 2026 14:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alert #10 and the three other advisories
npm auditreports againstclients/passkeys-browser.All four are development-only, transitive dependencies —
npm audit --omit=devwas already clean, and nothing here reaches published SDK output.postcss — GHSA-r28c-9q8g-f849, high
Path traversal in source-map auto-loading: postcss ≤ 8.5.17 follows a
sourceMappingURLcomment without constraining the path, so a crafted stylesheet can disclose an arbitrary.mapfile from the build machine. Reached viatsupand viavite(throughvitest).Every dependent range (
postcss-load-config >=8.0.9,tsup ^8.4.12,vite ^8.5.16) already admits the patched line, sonpm update postcssfixes it as a lockfile-only change — 8.5.16 → 8.5.25, carryingnanoid3.3.12 → 3.3.16.The rest
brace-expansionnpm audit fixqsqs.stringifycrashes on null entries in comma-format arrays withencodeValuesOnlytyped-rest-clientqsadvisory; clears with itqsarrives through@stryker-mutator/core→typed-rest-client, which pinsqsat an exact6.15.1— its latest 3.0.0 still does — sonpm audit fixcannot move it. Hence a"qs": "^6.15.2"entry alongside the existingesbuildoverride; it resolves 6.15.3 and carriesside-channel1.1.0 → 1.1.1. Worth dropping oncetyped-rest-clientpicks up a patchedqs.Verification
npm auditreports no vulnerabilities. On a cleannpm ci: 10 test files / 103 tests pass,npm run buildproduces ESM + CJS + d.ts, and Stryker still resolves (9.6.1).🤖 Generated with Claude Code