chore(deps): scoped npm overrides for the audit backlog + parent replacement by Prekzursil · Pull Request #291 · Prekzursil/WebCoder

Prekzursil · 2026-11-04T22:37:50Z

What

Closes the Dependabot/npm audit backlog with scoped overrides (owner-specified versions) plus one parent replacement:

Direct pins: minimatch 11.0.1, glob 14.0.2, decode-uri-component 0.5.1, qs 6.16.0, form-data 2.5.6, uuid 11.1.1, diff 3.5.1, tough-cookie 4.1.3, minimist 0.2.4, http-cache-semantics 4.1.1, got 11.8.5, hull.js 1.0.6 (the intended 1.0.10 does not exist on npm — registry latest is 1.0.6; verified via registry.npmjs.org).

Parent replacement: scratch-blocks pins scratch-l10n ^3.18.357 — that ancient nested copy is the SOLE consumer of the abandoned download@8 / transifex@1.6.6 chain. Overriding it to 6.2.3 (same Scratch org package, which drops both) removes from the tree entirely: download, transifex, request, decompress, got@8, qs@6.5, form-data@2.3, uuid@3, tough-cookie@2.5, mocha's diff@3/glob@7/minimist@0.0.8, http-cache-semantics@3.8.1, decode-uri-component@0.2.2.

Measured

npm audit after: 2 root advisories remain (was 24 open Dependabot alerts):
- google-closure-library — fix requires scratch-blocks@2.2.4 (semver-major) → owner decision.
- hull.js — advisory patch is 1.0.10, which is not published; pinned to latest 1.0.6.
npm run test locally: 634 passed (vitest), so the minimatch/glob/uuid/hull pins do not break the unit suite.
Lockfile: -1902 lines.

Merge after #263 (carries the same biome-format normalization via cherry-pick).

…acement Direct pins (per owner decision): minimatch 11.0.1, glob 14.0.2, decode-uri-component 0.5.1, qs 6.16.0, form-data 2.5.6, uuid 11.1.1, diff 3.5.1, tough-cookie 4.1.3, minimist 0.2.4, http-cache-semantics 4.1.1, got 11.8.5, hull.js 1.0.6. Parent replacement: scratch-blocks' nested scratch-l10n 3.18.357 is the sole consumer of the abandoned download@8 / transifex@1.6.6 chain; overriding it to 6.2.3 (same Scratch org package, drops both) removes download, transifex, request, decompress, got@8, qs@6.5, form-data@2, uuid@3, tough-cookie@2.5, mocha's diff@3/glob@7/minimist@0.0.8, http-cache-semantics@3.8.1 and decode-uri-component@0.2.2 from the tree entirely. hull.js is pinned to 1.0.6, the latest published release; the advisory patch (1.0.10) is not on npm yet. google-closure-library needs a scratch-blocks major bump - left as an owner decision. npm audit: 24 open alerts -> 2 root advisories remaining.

…errides

Main's mobile-wave (#289) and onboarding (#290) commits landed unformatted TS/JS (the quality lane's biome ci fails on main's head too); normalize with the gate's own pinned formatter (@biomejs/biome@2.5.0 'biome format --write .') so the lean quality gate can go green on this branch.

chatgpt-codex-connector · 2026-11-04T22:38:01Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T18:59:41.162731Z	`d4f7d08`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1bf293edd7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-04T22:42:02Z

  "overrides": {
-    "katex": "^0.19.1"
+    "katex": "^0.19.1",
+    "minimatch": "11.0.1",


Scope the minimatch override away from ESLint

The global override replaces ESLint's minimatch@^3.1.5 with v11, but @eslint/eslintrc (loaded by this repository's FlatCompat configuration) default-imports minimatch, while v11 provides only named exports. Consequently every npm run lint fails while loading eslint.config.mjs with SyntaxError: ... does not provide an export named 'default', preventing the required canonical verification command from completing; remove this global override or scope it only to consumers compatible with v11.

AGENTS.md reference: AGENTS.md:L14-L20

Useful? React with 👍 / 👎.

…edupe, lock regenerated (#298) 22 of 23 advisories cleared by real dependency changes (no dismissals): - scratch-blocks' nested scratch-l10n@3.18.357 deduped to ^6.2.3, killing the transifex chain (request SSRF, qs, form-data, tough-cookie@2, uuid@3, mocha@4's diff@3.3.1/minimist@0.0.8) and the download chain (decompress Zip-Slip family, got@8, http-cache-semantics@3.8.1, decode-uri-component@0.2.2). - minimatch: scoped to ^11.0.1 ONLY under scratch-l10n and @typescript-eslint/typescript-estree — the flagged (>=9,<11.0.1) instances. @eslint/eslintrc default-imports minimatch and its 3.x line is NOT in the advisory range (momentstudio main runs 3.1.5 alert-free), so eslint keeps minimatch@3.1.5 and does not crash (the global-11 override breaks ESLint with ESM SyntaxError — observed failing on PR #291's build-test). - glob ^14.0.2 (scratch-l10n's glob@13), uuid ^11.1.1 (scratch-vm), google-closure-library 20200315.0.0 (scratch-blocks). - hull.js@0.2.10 (GHSA-q849-wxrc-vqrp, critical): NO fixed release exists — the advisory's first patched version 1.0.10 was never published; npm's latest is 1.0.6 (verified 2026-11-03). Documented residual risk, NOT dismissed. Revisit when upstream publishes >=1.0.10. - dependabot.yml: docker rail for backend/Dockerfile added (one rail per manifest tree). owner-directed automation; --admin documented

…atch ^11.0.1, glob ^14.0.2; deepmerge@4.3.1 has no fixed release (documented residual)

…tch override (which crashed @eslint/eslintrc's default import)

sentry · 2026-11-13T18:58:15Z

    "jest-expo": "~58.0.0",
    "test-renderer": "^1.3.1",
    "typescript": "~5.9.0"
+  },
+  "overrides": {
+    "node-forge": "^1.4.3",
+    "minimatch": "^11.0.1",
+    "glob": "^14.0.2"
  }
 }


Bug: Global overrides for glob and minimatch force breaking major versions on test-exclude@6.0.0, causing runtime errors when executing jest --coverage.
_{Severity: MEDIUM}

Suggested Fix

Add an override for test-exclude to ^7 in mobile/package.json, or avoid using global overrides for glob and minimatch that conflict with test-exclude@6.0.0.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: mobile/package.json#L39-L48 Potential issue: Global overrides forcing `glob` to `^14.0.2` and `minimatch` to `^11.0.1` break `test-exclude@6.0.0`, which is loaded indirectly via `babel-plugin-istanbul` and `@jest/transform` during `jest --coverage`. `test-exclude@6` expects `glob` and `minimatch` to export functions (as in older versions), running `promisify(require('glob'))`. With glob 10+ and minimatch 11 exporting objects instead, this throws an `ERR_INVALID_ARG_TYPE` error at load time.

Also affects:

mobile/jest.config.js:7~30

_{Did we get this right? 👍 / 👎 to inform future reviews.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4f7d0828b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-13T18:59:38Z

+  "overrides": {
+    "node-forge": "^1.4.3",
+    "minimatch": "^11.0.1",
+    "glob": "^14.0.2"


Preserve the callback-based glob dependency used by Jest 29

In the mobile test lane, this global override replaces jest-runtime@29.7.0's glob@^7.1.3 dependency with glob 14. Jest 29 initializes its glob helper by passing the default glob export to util.promisify, but glob 14 exports an object rather than the callback function expected by that code. Consequently, both mobile test commands fail during Jest startup with ERR_INVALID_ARG_TYPE, before executing any tests. Scope the override to compatible consumers or upgrade the Jest consumers rather than replacing their v7 dependency globally.

Useful? React with 👍 / 👎.

Prekzursil · 2026-11-13T19:50:36Z

fleet-sec status: the security half of this PR is now unblocked —

The ESLint crash is fixed: the global minimatch: 11.0.1 override was replaced (via the main merge in d4f7d08) with the scoped shape that merged to main in fix(deps): clear every open npm advisory — scoped overrides, parent dedupe, docker rail #298 — @typescript/eslintrc keeps minimatch 3.1.5 (unflagged by GHSA-g3hv, and v11 has no default export so a global override kills ESLint), while the flagged ≥9 instances (scratch-l10n, @typescript-eslint/typescript-estree) get ^11.0.1.
mobile/package.json now carries its own overrides: node-forge ^1.4.3 (clears all 4 node-forge advisories), minimatch ^11.0.1, glob ^14.0.2; deepmerge@4.3.1 has no fixed release (documented residual).

The remaining red (src/i18n.parity.test.ts: 'server-page keys missing from MESSAGES', plus the mobile parity test's fetch failures) is this PR's own in-flight i18n feature work — the dictionary edits your own code comments say must land in the same commit as the renders. Not touched by fleet-sec.

owner-directed automation; --admin documented

Prekzursil and others added 3 commits November 4, 2026 23:31

Merge remote-tracking branch 'origin/main' into chore/npm-security-ov…

52bb9cc

…errides

chatgpt-codex-connector Bot reviewed Nov 4, 2026

View reviewed changes

Prekzursil mentioned this pull request Nov 13, 2026

fix(deps): clear every open npm advisory — scoped overrides, parent dedupe, docker rail #298

Merged

Prekzursil added 2 commits November 13, 2026 20:55

fix(deps): mobile overrides — node-forge ^1.4.3 (4 advisories), minim…

a537240

…atch ^11.0.1, glob ^14.0.2; deepmerge@4.3.1 has no fixed release (documented residual)

Merge main: scoped root overrides from #298 replace the global minima…

d4f7d08

…tch override (which crashed @eslint/eslintrc's default import)

sentry Bot reviewed Nov 13, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Nov 13, 2026

View reviewed changes

Prekzursil mentioned this pull request Nov 13, 2026

fix(deps): mobile overrides — node-forge ^1.4.3 (clears 4 advisories), minimatch ^11.0.1, glob ^14.0.2 #305

Merged

Navigation Menu

Repository navigation

chore(deps): scoped npm overrides for the audit backlog + parent replacement - #291

chore(deps): scoped npm overrides for the audit backlog + parent replacement#291
Prekzursil wants to merge 5 commits into
mainfrom
chore/npm-security-overrides

Prekzursil commented Nov 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 4, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 4, 2026

Uh oh!

sentry Bot Nov 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 13, 2026

Uh oh!

Prekzursil commented Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Prekzursil commented Nov 4, 2026

What

Measured

Uh oh!

chatgpt-codex-connector Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

sentry Bot Nov 13, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 13, 2026

Choose a reason for hiding this comment

Uh oh!

Prekzursil commented Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Nov 4, 2026 •

edited

Loading