fix(security): close 10 alerts via overrides, re-triage the full alert set - #104
Merged
Conversation
…ate snapshot date to 2026-07-24
Copilot
AI
changed the title
[WIP] Fix React Router path traversal vulnerability in session storage
docs(security): triage GHSA-9583-h5hc-x8cw / CVE-2025-61686, update snapshot date
Jul 24, 2026
Contributor
|
Contributor
🎭 Visual regression results
Details
Skipped testsmobile-chrome › theme.spec.ts › QuantEcon theme — visual regression › launch-colab |
…ter-vulnerability
…t set Builds on Copilot's CVE-alias addition. Reviewing that PR surfaced that the snapshot date was being advanced without a re-triage: measured by package, SECURITY.md covered 13 of the 18 packages with open alerts, and four of the five uncovered ones had backward-compatible patched releases — exactly the case this file's own policy says to fix with an `overrides` entry rather than defer. Overrides added (10 alerts closed): brace-expansion 1.1.15 -> 1.1.18, 5.0.6 -> 5.0.9 3 high (ReDoS) js-yaml 3.14.2 -> 3.15.1, 4.1.1 -> 4.3.1 2 high + 2 medium sanitize-html 2.12.1/2.17.1 -> 2.17.6 1 medium @babel/core 7.29.0 -> 7.29.7 1 low brace-expansion and js-yaml each have two majors in the tree, so those are version-scoped like the existing `ws@^8.0.0` entry. The fifth, `linkify-it`, is a genuine major (4->5) with no 4.x fix, but it reaches the tree only via markdown-it@13 — already deferred as 13->14, and markdown-it@14 requires linkify-it ^5. Named explicitly under that deferral rather than left to be inferred. Also: SECURITY.md's own "Report a vulnerability" link still pointed at the pre-rename quantecon-theme-src (as did the #63 link), and the shell-quote row still read ^1.8.4 after #108 moved it to ^1.10.0. Both corrected, and the snapshot date set to the day the re-triage actually happened. Verified: all 18 packages with open alerts are now named in the file; overrides resolve to the patched versions; typecheck, 13 unit tests and 13 visual tests pass (sanitize-html sits in MyST's render path, so the visual suite is the meaningful check).
mmcky
changed the title
An independent review of the override set found two real defects: - sanitize-html: the ^2.17.5 caret resolved 2.17.6, which raises engines.node to >=22.12.0 — contradicting this theme's declared node >=20 support — and swaps htmlparser2 from v8 to the ESM-only v12. CI never noticed because it runs node 24. Now pinned EXACTLY to 2.17.5: the advisory-fixed floor (GHSA-vccv-cmxp-4j9h patched at 2.17.5), no engines constraint, htmlparser2 v10. The tree keeps a single sanitize-html copy. - brace-expansion@^5.0.0: the ^5.0.7 floor was below the 5.x patched versions in the GitHub advisory DB (GHSA-mh99 patched 5.0.8, GHSA-rgw5 patched 5.0.9) — this repo's Dependabot alerts only surface the 1.x ranges for those two, which is what the floor was mistakenly read from. The installed 5.0.9 was already safe; the declared floor now matches it (^5.0.9). SECURITY.md corrections from the same review: - Both rows updated with the reasoning above; the sanitize-html row also notes the override knowingly forces @jupyterlab/apputils past its declared ~2.12.1 range. - The "ws (7->8)" deferral was stale — ws@7 has no open alerts since 7.5.12 (#103) covers the last patched 7.5.11. Removed from the deferred list; the ws@^8.0.0 override row records it. - The tar deferral enumeration was missing two of the eight open GHSAs (GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp) — added. - The react-router row now records that GHSA-337j-9hxr-rhxg and GHSA-wrjc-x8rr-h8h6 have no 6.x fix at all (first patched in 7.18.0). Verified: all open-alert packages named in SECURITY.md and every override row matches package.json (both checked programmatically); resolved tree is sanitize-html 2.17.5 / htmlparser2 10.1.0 / brace-expansion 1.1.18 + 5.0.9; typecheck, 13 unit and 13 visual tests pass.
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s dependency-security posture by expanding overrides to pull vulnerable transitive packages up to patched versions, and updates SECURITY.md to reflect a full re-triage snapshot and corrected links.
Changes:
- Add several npm
overrides(version-scoped where multiple majors coexist) to resolve transitive vulnerable dependencies without major toolchain upgrades. - Update
SECURITY.mdwith corrected repository links, expanded override documentation, and an updated snapshot date + clearer triage rules. - Regenerate
package-lock.jsonto reflect the new resolved dependency graph (e.g., updatedjs-yaml,brace-expansion,sanitize-html,@babel/*).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| SECURITY.md | Updates vulnerability reporting links and documents the expanded override/triage set with a new snapshot date. |
| package.json | Adds new overrides entries intended to force patched transitive dependency versions. |
| package-lock.json | Lockfile updates reflecting the overridden resolutions and resulting dependency tree changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+75
to
+78
| "js-yaml@^3.0.0": "^3.15.0", | ||
| "js-yaml@^4.0.0": "^4.3.0", | ||
| "sanitize-html": "2.17.5", | ||
| "@babel/core": "^7.29.6" |
Comment on lines
+37
to
+40
| | `js-yaml@^3.0.0` | `^3.15.0` | GHSA-52cp-r559-cp3m / GHSA-h67p-54hq-rp68 — quadratic CPU consumption via YAML merge-key chains | | ||
| | `js-yaml@^4.0.0` | `^4.3.0` | same advisories, 4.x copy | | ||
| | `sanitize-html` | `2.17.5` (exact) | GHSA-vccv-cmxp-4j9h — incomplete URI-scheme validation. Pinned exactly: 2.17.5 is the advisory-fixed floor, while 2.17.6 raises `engines.node` to `>=22.12.0` (conflicting with this theme's node `>=20` support) and swaps htmlparser2 to the ESM-only v12. Note this override knowingly forces `@jupyterlab/apputils` past its declared `~2.12.1` range (CI, including the real-lecture preview build, is green on the forced version) | | ||
| | `@babel/core` | `^7.29.6` | GHSA-4x5r-pxfx-6jf8 — arbitrary file read via `sourceMappingURL` comment (low; build-time) | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Original scope (Copilot)
Dependabot alert for
@remix-run/node(GHSA-9583-h5hc-x8cw / CVE-2025-61686): path traversal viacreateFileSessionStorage()with an unsigned cookie, patched only in2.17.2(Remix v2 / React Router v7).Reachability: not reachable.
createFileSessionStorageis never called in this codebase — the only session isgetThemeSessioninapp/root.tsx, which is cookie-backed via@myst-theme/site. Verified independently during review. The version isn't bumped because the only fix is Remix v2, deliberately deferred (Remix ≥1.19 causes an infinite reload loop under the mystmd CLI's SSR — #63).The original change was to add the
CVE-2025-61686alias and advance the snapshot date. The alias is kept. The date bump is what prompted the expansion below.Why this PR grew
Advancing "Snapshot as of" asserts a re-triage that hadn't happened. Measured by package,
SECURITY.mdcovered 13 of the 18 packages with open alerts — and four of the five uncovered ones had backward-compatible patched releases, which is precisely the case this file's own policy says to fix with anoverridesentry rather than defer:So the gap wasn't only documentation — it was actionable work sitting undone behind a date stamp.
Overrides added — 10 alerts closed
brace-expansionjs-yamlsanitize-html@babel/coresourceMappingURL)brace-expansionandjs-yamleach have two majors resolved in the tree, so those overrides are version-scoped, following the existingws@^8.0.0precedent.sanitize-htmlis pinned exactly to 2.17.5 (the advisory-fixed floor): 2.17.6 raisesengines.nodeto>=22.12.0— conflicting with the theme's node>=20support — and swaps htmlparser2 to the ESM-only v12; CI runs node 24 and would never have surfaced that. Thebrace-expansion5.x floor is^5.0.9, matching the advisory DB's 5.x patched versions (5.0.8/5.0.9) rather than this repo's alert view, which only surfaces the 1.x ranges for two of the three advisories.The fifth uncovered package,
linkify-it, is a genuine major (4→5) with no 4.x fix — but it reaches the tree only as amarkdown-itdependency, andmarkdown-itis already deferred as 13→14 (which requireslinkify-it ^5). It's now named explicitly under that deferral rather than left to be inferred.Documentation corrections found along the way
quantecon-theme-src, as did the#63link. Both updated (same staleness Use the current repo name in PLAN.md's comparison table #110 fixed inPLAN.md).shell-quoterow still read^1.8.4after build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 #108 moved the override to^1.10.0.Adversarial review
The expanded change was itself reviewed by an independent multi-agent pass (overrides/lockfile semantics, every SECURITY.md claim re-derived from the Dependabot API, upstream-changelog behavioral risk), which caught both floor defects above plus three doc staleness items now fixed: the
ws (7→8)deferral (ws@7 has no open alerts since #103), two missing GHSAs in the tar enumeration, and the react-router row not recording that two advisories have no 6.x fix (first patched in 7.18.0). The review also confirmed: the version-range override keys behave as intended (per-major scoping, verified in the resolved lockfile), the full lockfile diff has an empty "unexplained" bucket, no vulnerable versions remain anywhere in the tree, and the@jupyterlab/apputilsrange-override is legal, intended npm behavior (now noted in SECURITY.md).Verification
SECURITY.md, and every override row matchespackage.jsonexactly (both checked programmatically).sanitize-htmlsits in MyST's render path.Snapshot date set to the day the re-triage actually happened.