Repository navigation
fix(deps): security bumps for 15 packages with known CVEs (seroval critical first) - #8624
Closed
cwschroeder wants to merge 2 commits into
Closed
cwschroeder wants to merge 2 commits into
cwschroeder wants to merge 2 commits into
Conversation
Security sweep, acute first: seroval (CRITICAL GHSA-p6vx-979v-rg4c), then HIGHs in @tiptap/core, browserslist, markdown-it, nanoid, prosemirror-view, seroval, source-map-js, vite, zod, and MODERATE/LOW fixes for @babel/core, @vitest/mocker, baseline-browser-mapping, postcss, postcss-selector-parser. Mechanism: exact-version overrides in pnpm-workspace.yaml so only the vulnerable resolved versions move — no whole-tree upgrade. All target versions are at least 48h old. Lockstep pins forced by the bumps (each documented inline): - @tiptap family 3.22.5 -> 3.32.0 (core 3.32.0 breaks with 3.22.5 siblings: @tiptap/react imports cancelPositionCheck, removed from core) - prosemirror-view 1.42.3, prosemirror-transform 1.12.4 (duplicate private classes broke desktop tsc) - linkifyjs 4.4.0 (extension-link registered the buzz protocol in its own linkifyjs copy; composer autolink lost it) postcss-selector-parser takes 6.1.5, the 6.x-line fix of GHSA-rj75-hqrm-r3gf, instead of 7.1.7: the only consumer (@tailwindcss/typography 0.5.20) pins 6.0.10 exactly. Signed-off-by: Christian Schröder <[email protected]>
🔐 Codex Security Review
|
Review findings on 7c1fd3b: @tiptap/pm 3.32.0 floated prosemirror-model 1.25.12 while tiptap-markdown kept 1.25.4 (duplicate instance classes across the markdown-to-editor boundary) — one package-wide copy now. postcss is pinned 8.5.23 tree-wide explicitly instead of converging implicitly (the tailwind path floated 8.5.26, also fixed). Signed-off-by: Christian Schröder <[email protected]>
Author
|
Addressed both review findings in af329e9:
Re-verified on the clean tree: |
SanHsien
added a commit
to SanHsien/buzz
that referenced
this pull request
Oct 28, 2026
…s 8618-8641 All 20 upstream commits merged in 0b71418 with no conflicts; the only fork-patched file upstream touched is _ci-rust.yml (a version number in a comment), and the fork's Windows cold-build timeout patch survived. The 19 open PRs wait for merge; block#8624 is noted as the upstream fix for the tiptap/prosemirror alerts this fork already decided to wait on, and block#8643 for Hermes-backed agents. Watermarks move to 24a3706 / PR 8643 / issue 8641. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Author
|
Opened against upstream by mistake from an automated dependency job meant for our fork. Closing, sorry for the noise. |
SanHsien
added a commit
to SanHsien/buzz
that referenced
this pull request
Oct 29, 2026
…dvance all three watermarks 32 commits, 54 PRs and 2 issues ruled on with pinned head SHAs; no product change adopted yet. The block#8624 trigger is rewritten now that it closed unmerged. Executed from the roadmap's near-term table; the finished row is removed in the same commit. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: SanHsien <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security sweep: 15 packages with known CVEs lifted above their fixed versions
One PR, acute first. Mechanism: exact-version overrides in
pnpm-workspace.yaml(
"pkg@vulnerable": "fixed") so only the vulnerable resolved versions move —no whole-tree upgrade. Every target version was verified to be ≥48 h old before
use (oldest margin: baseline-browser-mapping 2.11.32 at ~92 h).
Deviations from the scan report (deliberate, documented inline)
advisory in 6.1.5 (6.x line) and 7.1.6+ (7.x line). The only consumer,
@tailwindcss/[email protected](latest), pins6.0.10exactly — forcing amajor on it was not worth it when the same-major line carries the fix.
(
@tiptap/reactimportscancelPositionCheck, which 3.32.0 removed), so thewhole @tiptap family (29 packages) moves to 3.32.0 together, plus
@tiptap/pm3.32.0 for its peer. No own advisories on the siblings.prosemirror-view1.42.3 andprosemirror-transform1.12.4 package-wide (duplicate private classes brokedesktoptsc),linkifyjs4.4.0 (extension-link 3.32.0 registered thebuzz://protocol in its own linkifyjs copy — composer autolink silentlylost it; caught by
composerLinkPastePipelinetests).floats
^2.10.44, which resolved 2.11.33 (45 h old — inside the Karenzwindow). Package-wide pin to 2.11.32 clears the Karenz.
8.5.26; 8.5.23 is the fixed version, both far beyond Karenz).
Verification
pnpm install --frozen-lockfilefrom a clean tree: single copy of everytouched package, no stale versions in
pnpm-lock.yaml.pnpm -r check(desktop / web / admin-web): green.desktop pnpm typecheck+web pnpm typecheck: green.desktop pnpm test: 6834/6834 pass (+ jsdom suite 161/161) — includes thelink-paste pipeline tests that exercise the linkifyjs registration path.
web pnpm buildanddesktop pnpm build: built successfully on vite 8.1.6.