Skip to content

fix(security): resolve all 11 open Dependabot alerts (fast-uri, js-yaml, linkify-it, undici, react-router) - #80

Merged
pacphi merged 4 commits into
mainfrom
fix/dependabot-security-alerts
Aug 25, 2026
Merged

fix(security): resolve all 11 open Dependabot alerts (fast-uri, js-yaml, linkify-it, undici, react-router)#80
pacphi merged 4 commits into
mainfrom
fix/dependabot-security-alerts

Conversation

@pacphi

@pacphi pacphi commented Aug 25, 2026

Copy link
Copy Markdown
Owner

Summary

Triages and fixes all 11 open Dependabot security alerts. Every alert had a patched release available within existing semver ranges; per the agreed strategy, dependencies were also floated to latest in-range and verified.

Alerts Package From → To Advisory Severity Exposure
#105 #106 #116 fast-uri 3.1.2 → 3.1.6 GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx, GHSA-7p8r-x3mc-p8w7 High dev-only (secretlint → ajv/table)
#121 js-yaml 4.3.0 → 4.3.1 GHSA-5p4m-2wfm-xmqj High dev-only (markdownlint-cli2, secretlint)
#104 linkify-it 5.0.1 → 5.0.2 GHSA-v245-v573-v5vm High dev-only (markdown-it)
#110–#114 undici 7.28.0 → 7.29.0 CVE-2026-13697 et al. High/Med dev-only (jsdom/vitest)
#117 react-router 7.18.0 → 7.18.2 GHSA-qwww-vcr4-c8h2 High runtime (react-router-dom)

Triage notes

  • react-router CSRF (the only runtime alert): per the advisory, the bypass affects only the unstable RSC-mode code paths (patched in 7.18.2 / 8.3.0). Ampel is a Vite SPA using react-router-dom in library mode, so it was not exploitable here — patched regardless.
  • undici CVE-2026-13697 requires the shared-mode cache interceptor against a hostile upstream; in this repo undici exists only inside jsdom's test environment.
  • The fast-uri / js-yaml / linkify-it DoS + host-confusion issues sit under lint/secret-scan tooling (dev scope), so exposure was limited to CI/local tooling.
  • Newer majors exist (js-yaml 5.x, fast-uri 4.x, linkify-it 6.x, react-router 8.x) but are capped by their parents (secretlint, markdownlint, jsdom) or would be a breaking app upgrade; not needed to clear any alert.
  • No Rust/Cargo alerts were open — this pass is npm-only.

Verification

  • pnpm audit — zero known vulnerabilities in both root and frontend workspaces
  • Frontend: ESLint clean, 924 vitest tests passed (6 skipped), production build succeeds
  • make format-check passes (rustfmt + Prettier)
  • Backend untouched (no Cargo changes)

🤖 Generated with Claude Code

https://claude.ai/code/session_01NMJhkk3m8nKUDggB3GY6DH

pacphi added 2 commits August 25, 2026 07:56
@pacphi
fix(security): bump root dev deps to clear fast-uri, js-yaml, linkify…
c18e717 
…-it advisories

Resolves Dependabot alerts #104, #105, #106, #116, #121:
- fast-uri 3.1.2 -> 3.1.6 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676,
  GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, GHSA-7p8r-x3mc-p8w7 /
  CVE-2026-18446 — host confusion via backslash/IDN handling)
- js-yaml 4.3.0 -> 4.3.1 (GHSA-5p4m-2wfm-xmqj — quadratic CPU in
  !!omap resolution)
- linkify-it 5.0.1 -> 5.0.2 (GHSA-v245-v573-v5vm / CVE-2026-59887 —
  quadratic-complexity DoS in mailto: validator)

All are dev-scope transitives of secretlint/markdownlint-cli2; direct
devDependencies floated to latest in-range (secretlint 13.0.4,
prettier 3.9.6).
@pacphi
fix(security): patch react-router CSRF and five undici CVEs in frontend
3cae332 
Resolves Dependabot alerts #110-#114, #117:
- react-router 7.18.0 -> 7.18.2 via react-router-dom ^7.18.2
  (GHSA-qwww-vcr4-c8h2 — RSC-mode CSRF bypass; Ampel uses library
  mode so it was not exploitable, patched regardless)
- undici 7.28.0 -> 7.29.0, dev-only via jsdom (CVE-2026-13697,
  CVE-2026-14643, CVE-2026-15157, CVE-2026-16728, CVE-2026-16729 —
  cache-poisoning disclosure, CRLF/cookie injection, retry desync)

Remaining frontend deps floated to latest in-range per pnpm update
(react 19.2.8, vite 8.2.2, vitest 4.1.11, msw 2.15.0, tailwind 4.3.3,
axios 1.19.0, etc.). Verified: ESLint clean, 924 vitest tests pass,
production build succeeds, pnpm audit reports zero vulnerabilities.
@pacphi

pacphi commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

pacphi added 2 commits August 25, 2026 08:16
@pacphi
fix(security): bump h2 to 0.4.19 for RUSTSEC-2026-0258
9d52f49 
New advisory (published 2026-08-17) flagged h2 0.4.15 for unbounded
empty DATA frames; fixed in >=0.4.16. Lockfile-only bump of the
transitive hyper/axum dependency. cargo audit passes locally with
only the 7 pre-allowed warnings; cargo check --all-features clean.
@pacphi
fix(security): bump lru to 0.18.2 for RUSTSEC-2026-0253
8c19ff1 
cargo-deny's advisories gate (surfaced once the h2 audit failure was
cleared) errors on the unsound advisory for lru <0.18.2: missing
panic safety in LruCache::pop() can leave dangling pointers in the
internal linked list. lru is a direct dependency of ampel-i18n-builder
(translator response caches). 0.16 -> 0.18.2 required no code changes;
crate tests pass, and cargo deny check advisories + cargo audit are
both clean locally.
@github-actions

github-actions Bot commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Coverage Report

Component Coverage Status
Backend N/A% ❓
Frontend N/A% ❓
Overall N/A% ❓

Coverage Thresholds

  • 🟢 Green: ≥ 80% (target)
  • 🟡 Yellow: 60-79% (acceptable)
  • 🔴 Red: < 60% (needs improvement)

Coverage reports generated by CI workflow

@pacphi
pacphi merged commit a458428 into main Aug 25, 2026
23 checks passed
@pacphi
pacphi deleted the fix/dependabot-security-alerts branch August 25, 2026 15:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pacphi