|
|
- **Bumped two frontend dev-tooling dependencies with denial-of-service advisories (GHSA-3jxr-9vmj-r5cp, GHSA-52cp-r559-cp3m)** — `brace-expansion` and `js-yaml`, both pulled in transitively by `eslint` (via `minimatch` and `@eslint/eslintrc`), were flagged by `npm audit`. They are build/lint-time tooling only and are not part of the shipped app, so no running Bambuddy install was ever exposed. `npm audit fix` couldn't move eslint to the patched versions on its own, so they're pinned to the fixed releases through the existing `overrides` block in `frontend/package.json` (`brace-expansion ^5.0.7`, `js-yaml ^4.3.0`). `npm audit` now reports zero vulnerabilities and eslint still runs clean.
|
|
- **Bumped two frontend dev-tooling dependencies with denial-of-service advisories (GHSA-3jxr-9vmj-r5cp, GHSA-52cp-r559-cp3m)** — `brace-expansion` and `js-yaml`, both pulled in transitively by `eslint` (via `minimatch` and `@eslint/eslintrc`), were flagged by `npm audit`. They are build/lint-time tooling only and are not part of the shipped app, so no running Bambuddy install was ever exposed. `npm audit fix` couldn't move eslint to the patched versions on its own, so they're pinned to the fixed releases through the existing `overrides` block in `frontend/package.json` (`brace-expansion ^5.0.7`, `js-yaml ^4.3.0`). `npm audit` now reports zero vulnerabilities and eslint still runs clean.
|
|
|
- **Raised the Docker image's pip floor to 26.1.2 (PYSEC-2026-196)** — The image already upgraded pip before installing requirements, but the floor was `pip>=26.1` while PYSEC-2026-196's fix is specifically 26.1.2 (the related PYSEC-2026-2875/2876 are fixed in 26.1). `--upgrade` grabbed the latest in practice, but the loose floor could resolve 26.1.0/26.1.1, which are still vulnerable; the pin now matches the advisory exactly. Build tooling only — pip is not part of the running app.
|
|
- **Raised the Docker image's pip floor to 26.1.2 (PYSEC-2026-196)** — The image already upgraded pip before installing requirements, but the floor was `pip>=26.1` while PYSEC-2026-196's fix is specifically 26.1.2 (the related PYSEC-2026-2875/2876 are fixed in 26.1). `--upgrade` grabbed the latest in practice, but the loose floor could resolve 26.1.0/26.1.1, which are still vulnerable; the pin now matches the advisory exactly. Build tooling only — pip is not part of the running app.
|
|
|
|
|
+- **Bumped `linkify-it` and `dompurify` to their patched releases (GHSA-v245-v573-v5vm, GHSA-c2j3-45gr-mqc4)** — `npm audit` flagged both against the production dependency tree, and the Frontend Security CI job fails on any fixable high-severity finding there. **`linkify-it` 5.0.1 → 5.0.2** (high, CVSS 7.5) carries a quadratic-complexity denial-of-service in the `mailto:` validator's scan loop. It reaches Bambuddy only through `prosemirror-markdown` bundled inside `@tiptap/pm`; the rich-text editor's own autolinking uses `linkifyjs`, a different package that is not affected. Nothing under `frontend/src/` imports `prosemirror-markdown` or `markdown-it`, and neither string appears in the production bundle — the vulnerable code is tree-shaken out and never reaches a browser, so no running install was exposed. **`dompurify` 3.4.11 → 3.4.12** (low) lets `CUSTOM_ELEMENT_HANDLING` bypass an `afterSanitizeElements` hook for allowed custom elements. DOMPurify *is* shipped (MakerWorld summaries, project notes, the project-page modal), but Bambuddy never sets `CUSTOM_ELEMENT_HANDLING` — the default rejects custom elements outright — and registers no `afterSanitizeElements` hook, so the bypass has no precondition to stand on; the project-page modal additionally passes a strict `ALLOWED_TAGS`/`ALLOWED_ATTR` allowlist. Both patched versions already satisfy the ranges their parents declare, so this is a lockfile-only change: no `overrides` entry was needed and `frontend/package.json` is untouched. `npm audit` now reports zero vulnerabilities across the production tree, `npm run build` is clean, and all 2423 frontend tests pass.
|
maziggy