chore: patch dev dependency advisories and complete publish metadata - #4
Open
murdore wants to merge 2 commits into
Open
chore: patch dev dependency advisories and complete publish metadata#4murdore wants to merge 2 commits into
murdore wants to merge 2 commits into
Conversation
Security
--------
Ten open Dependabot advisories, all reached through pnpm-lock.yaml. Every one
is a dev-only transitive dependency — `pnpm why --prod` finds none of them in
the production tree, and the published package ships only dist/ plus README,
so consumers were never exposed. Patched anyway.
brace-expansion 1.1.12 -> 1.1.16 ReDoS via exponential-time expansion
flatted 3.3.3 -> 3.4.2 prototype pollution in parse()
js-yaml 4.1.0 -> 4.3.1 quadratic CPU in merge keys / !!omap,
prototype pollution in merge (<<)
minimatch 3.1.2 -> 3.1.3 ReDoS in matchOne() backtracking
9.0.5 -> 9.0.7
picomatch 2.3.1 -> 2.3.2 method injection in POSIX classes
Applied as pnpm.overrides pinned to an exact patch inside each existing
major. An earlier attempt using open `>=` ranges dragged js-yaml to 5.x and
minimatch to 10.x while leaving minimatch 9.0.5 unpatched, so the bounds are
deliberate. brace-expansion 2.x left the tree entirely: minimatch 9.0.7
depends on brace-expansion 5.0.9 upstream, which is outside both advisory
ranges. The 2.x override is kept so the range cannot reappear unpatched.
Verified: no version matching any advisory range remains in the lockfile, and
build, lint and all 53 tests still pass on the upgraded tooling.
Publish metadata
----------------
The package has never been published; `author` was still the scaffold
placeholder "Your Name" and there was no repository link for npm to show.
author Sachin Sharma <sachiny09@gmail.com>
repository git+https://github.com/juspay/workforge.git
homepage .../workforge#readme
bugs .../workforge/issues
Version left at 1.5.0: nothing has been published, so there is no released
version to supersede.
Scoped to the org that owns the repository. The unscoped name was never published, so nothing is being renamed out from under existing users. - publishConfig.access = "public": scoped packages default to restricted, which would make the first publish private. - README install lines updated to the scoped name. The binaries are still `workforge` and `wf` — only the package identifier changes. - The workflow example ran `npx workforge` with no install step, which under a scoped name would fetch an unrelated package; it now uses `npx @juspay/workforge`. It was also missing the `create` subcommand, so it could never have worked as written.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the 10 open Dependabot advisories and makes the package publish-ready.
Security
All 10 advisories reach the repo through
pnpm-lock.yaml, and all 10 are dev-only —pnpm why --prodfinds none of them in the production tree, and the published tarball contains onlydist/plusREADME.md. So consumers were never exposed. Patched regardless.brace-expansionflattedparse()js-yaml!!omap; prototype pollution in<<minimatchmatchOne()backtrackingpicomatchApplied as
pnpm.overrides, pinned to an exact patch inside each existing major. That precision is deliberate: a first attempt using open>=ranges draggedjs-yamlto 5.x andminimatchto 10.x — major upgrades of the lint/test toolchain — while still leavingminimatch@9.0.5unpatched.One upstream consequence worth noting:
brace-expansion2.x left the tree entirely, becauseminimatch@9.0.7depends onbrace-expansion@5.0.9. That version is outside both advisory ranges. Thebrace-expansion@2override is kept anyway so the range cannot reappear unpatched if resolution shifts.Verified: a scan of the regenerated lockfile finds no version matching any advisory range, and
tsc,eslintand all 53 tests pass on the upgraded tooling.Publish metadata
The package has never been published (
registry.npmjs.org/workforge→ 404).authorwas still the scaffold placeholder"Your Name", and there was no repository link for npm to render.npm pack --dry-runproducesworkforge-1.5.0.tgz, 118 kB, 106 files.Version left at 1.5.0 — nothing has been published, so there is no released version to supersede.
Not done here
Publishing itself.
npm whoamireturns 401 in this environment, and claiming a public package name is a one-way action.