Repository navigation
fix(deps): clear every open npm advisory — scoped overrides, parent dedupe, docker rail - #298
Conversation
…edupe, lock regenerated 22 of 23 advisories cleared by real dependency changes (no dismissals): - scratch-blocks' nested scratch-l10n@3.18.357 deduped to ^6.2.3, killing the transifex chain (request SSRF, qs, form-data, tough-cookie@2, uuid@3, mocha@4's diff@3.3.1/minimist@0.0.8) and the download chain (decompress Zip-Slip family, got@8, http-cache-semantics@3.8.1, decode-uri-component@0.2.2). - minimatch: scoped to ^11.0.1 ONLY under scratch-l10n and @typescript-eslint/typescript-estree — the flagged (>=9,<11.0.1) instances. @eslint/eslintrc default-imports minimatch and its 3.x line is NOT in the advisory range (momentstudio main runs 3.1.5 alert-free), so eslint keeps minimatch@3.1.5 and does not crash (the global-11 override breaks ESLint with ESM SyntaxError — observed failing on PR #291's build-test). - glob ^14.0.2 (scratch-l10n's glob@13), uuid ^11.1.1 (scratch-vm), google-closure-library 20200315.0.0 (scratch-blocks). - hull.js@0.2.10 (GHSA-q849-wxrc-vqrp, critical): NO fixed release exists — the advisory's first patched version 1.0.10 was never published; npm's latest is 1.0.6 (verified 2026-11-03). Documented residual risk, NOT dismissed. Revisit when upstream publishes >=1.0.10. - dependabot.yml: docker rail for backend/Dockerfile added (one rail per manifest tree). owner-directed automation; --admin documented
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 181bff6ef8
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "version": "0.9.32", | ||
| "resolved": "https://registry.npmjs.org/@acemir/cssom/-/cssom-0.9.32.tgz", | ||
| "integrity": "sha512-OijrAUu7rrJhSIoHNg6LMPS5e344nwUHA+1EFYYjrh64D+GmytUsfBQjci45TjT+rd5Spsp8B5xsZDT+TgyXXQ==", | ||
| "license": "MIT" |
There was a problem hiding this comment.
The regenerated lockfile removes resolved and integrity from most retained packages, leaving only 151 integrity hashes across 1,046 dependency entries. On a clean installation, those packages are no longer checked against the artifact hashes committed and reviewed in this repository; npm instead obtains their metadata from the configured registry. If registry metadata or an artifact changes, the lockfile no longer provides the previous independent integrity check. Regenerate the lockfile with complete integrity metadata while retaining the dependency fixes.
Useful? React with 👍 / 👎.
…tch override (which crashed @eslint/eslintrc's default import)
Clears 22 of 23 open Dependabot alerts with real dependency changes (zero dismissals). Full detail in the commit message; highlights:
scratch-blocks' nestedscratch-l10n@3.18.357deduped to^6.2.3— kills thetransifexchain (request SSRF/GHSA-p8p7, qs, form-data, tough-cookie@2, uuid@3, mocha@4 → diff/minimist) and thedownloadchain (decompress Zip-Slip ×4, got@8, http-cache-semantics, decode-uri-component).minimatchoverridden to^11.0.1scoped underscratch-l10nand@typescript-eslint/typescript-estree(the flagged ≥9,<11.0.1 instances). eslint keeps 3.1.5, which the advisory does not flag — and a global-11 override crashes@eslint/eslintrc(import minimatch from 'minimatch'has no default export in v11; exactly what is failing on chore(deps): scoped npm overrides for the audit backlog + parent replacement #291's build-test today).docker /backendrail added (one rail per manifest tree).Note for #291: applying the same scoped-minimatch shape there will unbreak its build-test/verify/vitest.
owner-directed automation; --admin documented