fix(security): resolve open code-scanning & Dependabot alerts - #1398
Open
pathosDev wants to merge 2 commits into
Open
fix(security): resolve open code-scanning & Dependabot alerts#1398pathosDev wants to merge 2 commits into
pathosDev wants to merge 2 commits into
Conversation
- js/file-system-race (High): remove TOCTOU in build/docs tooling
- build-devtools-ui.mjs: read the generated module via try/catch
instead of existsSync()+readFile before the write
- scaffold.mjs: write stubs with the 'wx' flag (atomic EEXIST) instead
of existsSync()-then-write
- js/log-injection (Med): log only a sanitized message `kind` in the
voice plain example, never the raw server payload
- js/missing-origin-check (Med x3): document why origin checks do not
apply to dedicated Worker / worker_threads handlers (WorkerNode,
ParallelMultiNodeBootstrap, smoke fixture); these alerts are dismissed
on GitHub as false positives.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Resolves 4 Dependabot alerts in the example apps: - nanoid -> 3.3.18 (GHSA-2v37-7h3g-55p8, High) in voice/chat frontend-next; both package-lock.json and bun.lock. The bun.lock next bump (16.2.12 -> 16.3.3) is the lockfile catching up to the existing package.json range (^16.3.0); package.json itself is unchanged. - cookie -> 0.7.2 (GHSA-pxg6-pf52-xh8x, Low, dev) in voice/chat frontend-svelte via an `overrides` pin, since @sveltejs/kit constrains cookie to ^0.6.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // js/log-injection). | ||
| const kind = | ||
| typeof m?.kind === 'string' ? m.kind.replace(/[^\w.:-]/g, '') : '(unknown)'; | ||
| console.debug('unhandled server msg kind:', kind); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the open GitHub Security & quality items on
actor-ts: 6 CodeQL code-scanning alerts and 4 Dependabot alerts.Code scanning (CodeQL security-and-quality)
js/file-system-racescripts/build-devtools-ui.mjs— read the generated module viatry/catchinstead ofexistsSync()+readFilebefore the write (removes the TOCTOU check→write pair)js/file-system-racedocs/scripts/scaffold.mjs— write stubs with thewxflag (atomicEEXIST) instead ofexistsSync()-then-writejs/log-injectionexamples/voice/static/plain/index.html— log only a sanitized messagekind, never the raw server payloadjs/missing-origin-checksrc/worker/WorkerNode.ts— dismissed as false positive + explanatory commentjs/missing-origin-checksrc/testkit/internal/ParallelMultiNodeBootstrap.ts— dismissed + commentjs/missing-origin-checktests/smoke/fixtures/parallel-mns-worker-throws-after-ready.mjs— dismissed + commentThe three
missing-origin-checkfindings are in dedicated Worker / worker_threads message handlers, wherepostMessageorigin does not apply (messages come only from the trusted parent that spawned the worker; payloads are validated bykind). They were dismissed via the API with that justification; the added comments document why.Dependabot (4 alerts)
examples/{voice,chat}/frontend-next—package-lock.jsonandbun.lock. Thebun.locknextbump (16.2.12 → 16.3.3) is the lockfile catching up to the existingpackage.jsonrange (^16.3.0);package.jsonis unchanged.examples/{voice,chat}/frontend-sveltevia anoverridespin, since@sveltejs/kitconstrainscookieto^0.6.0.Verification
node --checkpasses on all edited.mjsscripts; TS edits are comment-only.nanoidandcookieconfirmed at safe versions in both npm and bun lockfiles..github/workflows/codeql.yml) will re-scan this PR — alerts 10/11/15 should clear; 12/13/14 stay dismissed.Out of scope — flagged for maintainer
npm auditsurfaced two findings that were not in GitHub's open alert list and are left untouched here:Happy to address these in a follow-up if desired.
🤖 Generated with Claude Code