fix(security): pin undici to patched 7.28.0 / 8.5.0 — green security-fast#83
Merged
Conversation
…security-fast) CI security-fast (prod audit) was failing on 6 HIGH undici advisories: GHSA-vmh5-mc38-953g (SOCKS5 TLS cert-validation bypass) + GHSA-38rv-x7px-6hhq / GHSA-vxpw-j846-p89q (WebSocket DoS via fragment bypass) + GHSA-hm92-r4w5-c3mj (cross-origin routing via SOCKS5 pool reuse). The tree resolved undici 7.27.2 (<7.28.0) and 8.3.0 (<8.5.0), both in the affected ranges. Pin each major in place via pnpm-workspace overrides (no risky 7->8 jump): undici@7 -> 7.28.0, undici@8 -> 8.5.0. The tree now resolves ONLY the patched versions; node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high reports 0 high advisories. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Author
|
Anvil hardening pushed a follow-up fix: a061d39 aligns the direct undici package specs and generated npm shrinkwraps with the existing pnpm override/lockfile pin. Proof run locally on the pushed head:
Result: fixed-ready from Anvil; draft CI skips are expected until the orchestrator flips the PR ready-for-review. |
LightDriverCS
marked this pull request as ready for review
June 23, 2026 02:19
Dependency GuardThis PR changes dependency-related files. Maintainers should confirm these changes are intentional. Changed files:
Maintainer follow-up:
|
Dependency graph changes notedThis PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of
Security review is still recommended before merge when the dependency graph change is intentional. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin
undicioverrides to the patched releases so thesecurity-fastprod audit goes green repo-wide.undici@7→ 7.28.0,undici@8→ 8.5.0 (each major bumped in place — no risky 7→8 jump).Why
6 HIGH advisories in production deps: GHSA-vmh5-mc38-953g (SOCKS5 TLS cert-validation bypass), GHSA-38rv-x7px-6hhq / GHSA-vxpw-j846-p89q (WebSocket DoS via fragment bypass), GHSA-hm92-r4w5-c3mj (cross-origin routing via SOCKS5 pool reuse). This is the same
security-fastred seen on #82 (pre-existing, not introduced there).Anvil-ready handoff
pnpm-workspace.yaml(+5 lines, override + GHSA comment) and the regeneratedpnpm-lock.yaml. 2 files.node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high→ "No high or higher advisories found" (was 6 HIGH).pnpm installclean; monorepo postinstall build ran.[email protected]+[email protected]resolved.🤖 Generated with Claude Code