fix(security): Fix npm audit vulnerabilities in glob and body-parser

[afarber]

Summary

Fixes 2 npm audit security vulnerabilities in transitive dependencies:

• HIGH severity: glob command injection vulnerability (CVSS 7.5)
• MODERATE severity: body-parser DoS vulnerability (CVSS 5.3)

Running npm audit now reports 0 vulnerabilities.

Details

Updated transitive dependencies to patched versions via npm audit fix:

• glob: 10.4.5 → 10.5.0 (fixes GHSA-5j98-mcp5-4vw2)
  • Affected packages: archiver-utils, test-exclude
• body-parser: 2.2.0 → 2.2.1 (fixes GHSA-wqch-xfxh-vrr4)
  • Affected packages: @modelcontextprotocol/sdk, [email protected]
• raw-body: 3.0.0 → 3.0.2 (dependency of body-parser)

Only package-lock.json modified for dependency updates. The NOTICES.txt file was auto-regenerated to reflect updated
license information for raw-body.

Related Issues

Fixes #14089

How to Validate

  npm audit # Expected: "found 0 vulnerabilities"

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[gemini-code-assist]

Summary of Changes

Hello @afarber, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing the project's security by patching critical vulnerabilities found in key transitive dependencies. By updating 'glob' and 'body-parser' to their latest secure versions, the PR ensures that the application is protected against known exploits, maintaining a robust and secure development environment.

Highlights

• Security Vulnerability Fixes: This pull request addresses and resolves two npm audit security vulnerabilities: a HIGH severity command injection vulnerability in the 'glob' package (CVSS 7.5) and a MODERATE severity Denial-of-Service (DoS) vulnerability in 'body-parser' (CVSS 5.3).
• Dependency Updates: The 'glob' package has been updated from version 10.4.5 to 10.5.0, and 'body-parser' has been updated from 2.2.0 to 2.2.1. Additionally, 'raw-body', a transitive dependency of 'body-parser', was updated from 3.0.0 to 3.0.2.
• Clean Audit Report: After these updates, running 'npm audit' now reports zero vulnerabilities, significantly improving the project's security posture.
• File Changes: The changes primarily involve updates to 'package-lock.json' to reflect the new dependency versions and an auto-regenerated 'NOTICES.txt' file to update license information for 'raw-body'.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request addresses two security vulnerabilities reported by npm audit by updating transitive dependencies. The changes correctly update glob to version 10.5.0 and body-parser to 2.2.1, which are the patched versions for the respective vulnerabilities. The modifications in package-lock.json are consistent with the output of npm audit fix and include some formatting changes like adding peer: true to several dependencies, which is expected with newer npm versions. The NOTICES.txt file has also been correctly updated to reflect the new version of raw-body. The pull request effectively resolves the security issues and is good to merge.

[afarber]

Hi @galz10 @bdmorgan, I've rebased onto main - could you please approve the workflow runs? Thanks!

[jackwotherspoon]

Got you covered @afarber 🫡

Workflows running now