fix(security): resolve open code-scanning & Dependabot alerts - #1398
Merged
Conversation
- js/file-system-race (High): remove TOCTOU in build/docs tooling
- build-devtools-ui.mjs: read the generated module via try/catch
instead of existsSync()+readFile before the write
- scaffold.mjs: write stubs with the 'wx' flag (atomic EEXIST) instead
of existsSync()-then-write
- js/log-injection (Med): log only a sanitized message `kind` in the
voice plain example, never the raw server payload
- js/missing-origin-check (Med x3): document why origin checks do not
apply to dedicated Worker / worker_threads handlers (WorkerNode,
ParallelMultiNodeBootstrap, smoke fixture); these alerts are dismissed
on GitHub as false positives.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Resolves 4 Dependabot alerts in the example apps: - nanoid -> 3.3.18 (GHSA-2v37-7h3g-55p8, High) in voice/chat frontend-next; both package-lock.json and bun.lock. The bun.lock next bump (16.2.12 -> 16.3.3) is the lockfile catching up to the existing package.json range (^16.3.0); package.json itself is unchanged. - cookie -> 0.7.2 (GHSA-pxg6-pf52-xh8x, Low, dev) in voice/chat frontend-svelte via an `overrides` pin, since @sveltejs/kit constrains cookie to ^0.6.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // js/log-injection). | ||
| const kind = | ||
| typeof m?.kind === 'string' ? m.kind.replace(/[^\w.:-]/g, '') : '(unknown)'; | ||
| console.debug('unhandled server msg kind:', kind); |
scripts/build-devtools-ui.mjs is part of the DevTools UI freshness hash (sourceHash() digests the build script itself), so the file-system-race fix invalidated the committed source-hash and tripped `check:ui`. Rebuilt via `bun run build:ui`; only the source-hash header changes — the embedded assets are byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Follow-up covering two advisories npm audit flagged that were not in the original Dependabot alert set: - @sveltejs/kit -> 2.70.3 (GHSA-29g2-3rmr-qm68, ReDoS in content negotiation) in voice/chat frontend-svelte. - nanoid -> 3.3.18 (GHSA-2v37-7h3g-55p8, High) transitive in the same svelte examples. Both package-lock.json and bun.lock updated; `npm audit` now reports 0 vulnerabilities across all four example front-ends. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pathosDev
force-pushed
the
fix/security-and-quality-alerts
branch
from
September 1, 2026 08:25
30a1c0c to
bf2eb8e
Compare
pathosDev
added a commit
that referenced
this pull request
Sep 1, 2026
fix(security): recognised sanitizer for js/log-injection (follow-up to #1398)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the open GitHub Security & quality items on
actor-ts(6 CodeQL code-scanning alerts + 4 Dependabot alerts), and additionally patches two advisoriesnpm auditsurfaced in the example apps so all four front-ends are audit-clean.Code scanning (CodeQL security-and-quality)
js/file-system-racescripts/build-devtools-ui.mjs— read the generated module viatry/catchinstead ofexistsSync()+readFilebefore the write (removes the TOCTOU check→write pair)js/file-system-racedocs/scripts/scaffold.mjs— write stubs with thewxflag (atomicEEXIST) instead ofexistsSync()-then-writejs/log-injectionexamples/voice/static/plain/index.html— log only a sanitized messagekind, never the raw server payloadjs/missing-origin-checksrc/worker/WorkerNode.ts— dismissed as false positive + explanatory commentjs/missing-origin-checksrc/testkit/internal/ParallelMultiNodeBootstrap.ts— dismissed + commentjs/missing-origin-checktests/smoke/fixtures/parallel-mns-worker-throws-after-ready.mjs— dismissed + commentThe three
missing-origin-checkfindings are in dedicated Worker / worker_threads message handlers, wherepostMessageorigin does not apply (messages come only from the trusted parent that spawned the worker; payloads are validated bykind). Dismissed via API with that justification; comments document why.Dependency updates (Dependabot + npm audit)
{voice,chat}/frontend-nextand{voice,chat}/frontend-svelte{voice,chat}/frontend-svelte(viaoverrides, since kit constrained^0.6.0){voice,chat}/frontend-svelteBoth
package-lock.jsonandbun.lockare updated in every case. Thefrontend-nextbun.locknextbump (16.2.12 → 16.3.3) is the lockfile catching up to the existingpackage.json^16.3.0. After this,npm auditreports 0 vulnerabilities across all four example front-ends.Verification
node --checkon all edited.mjs; TS edits are comment-only;bun run check:uipasses after regen.npm auditclean in all four example front-ends (nanoid/cookie/kit confirmed in npm and bun lockfiles).develop, 12/13/14 stay dismissed.🤖 Generated with Claude Code