Solve CVE #632
Solve CVE #632
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis pull request introduces an Changes
Assessment against linked issues
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
🚀 Snapshot Release (
|
| Package | Version | Info |
|---|---|---|
@graphql-tools/batch-delegate |
9.0.30-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/batch-execute |
9.0.12-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/delegate |
10.2.12-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/executor-common |
0.0.2-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/executor-graphql-ws |
2.0.2-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/executor-http |
1.2.7-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/federation |
3.1.2-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/fusion-runtime |
0.11.0-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-hive/gateway |
1.9.5-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/hmac-upstream-signature |
1.2.20-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/plugin-opentelemetry |
1.3.41-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/plugin-prometheus |
1.3.29-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-hive/gateway-runtime |
1.4.13-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/stitch |
9.4.17-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/stitching-directives |
3.1.27-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/transport-common |
0.7.29-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/transport-http |
0.6.33-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/transport-http-callback |
0.5.20-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-mesh/transport-ws |
1.0.3-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
@graphql-tools/wrap |
10.0.30-alpha-32434bbf345dd99ef88c7248d7f8b10e3f7cca8b |
npm ↗︎ unpkg ↗︎ |
🚀 Snapshot Release (Binary for
|
🚀 Snapshot Release (Binary for
|
🚀 Snapshot Release (Binary for
|
🚀 Snapshot Release (Node Docker Image)The latest changes of this PR are available as image on GitHub Container Registry (based on the declared |
🚀 Snapshot Release (Bun Docker Image)The latest changes of this PR are available as image on GitHub Container Registry (based on the declared |
🚀 Snapshot Release (Binary for
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (30)
examples/apq-subgraphs/example.tar.gzis excluded by!**/*.gzexamples/apq-subgraphs/package-lock.jsonis excluded by!**/package-lock.jsonexamples/extra-fields/example.tar.gzis excluded by!**/*.gzexamples/extra-fields/package-lock.jsonis excluded by!**/package-lock.jsonexamples/federation-example/example.tar.gzis excluded by!**/*.gzexamples/federation-example/package-lock.jsonis excluded by!**/package-lock.jsonexamples/federation-mixed/example.tar.gzis excluded by!**/*.gzexamples/federation-mixed/package-lock.jsonis excluded by!**/package-lock.jsonexamples/federation-subscriptions-passthrough/example.tar.gzis excluded by!**/*.gzexamples/federation-subscriptions-passthrough/package-lock.jsonis excluded by!**/package-lock.jsonexamples/file-upload/example.tar.gzis excluded by!**/*.gzexamples/file-upload/package-lock.jsonis excluded by!**/package-lock.jsonexamples/hmac-auth-https/example.tar.gzis excluded by!**/*.gzexamples/hmac-auth-https/package-lock.jsonis excluded by!**/package-lock.jsonexamples/interface-additional-resolvers/example.tar.gzis excluded by!**/*.gzexamples/interface-additional-resolvers/package-lock.jsonis excluded by!**/package-lock.jsonexamples/json-schema-subscriptions/example.tar.gzis excluded by!**/*.gzexamples/json-schema-subscriptions/package-lock.jsonis excluded by!**/package-lock.jsonexamples/openapi-arg-rename/example.tar.gzis excluded by!**/*.gzexamples/openapi-arg-rename/package-lock.jsonis excluded by!**/package-lock.jsonexamples/openapi-subscriptions/example.tar.gzis excluded by!**/*.gzexamples/openapi-subscriptions/package-lock.jsonis excluded by!**/package-lock.jsonexamples/operation-field-permissions/example.tar.gzis excluded by!**/*.gzexamples/operation-field-permissions/package-lock.jsonis excluded by!**/package-lock.jsonexamples/programmatic-batching/example.tar.gzis excluded by!**/*.gzexamples/programmatic-batching/package-lock.jsonis excluded by!**/package-lock.jsonexamples/subscriptions-with-transforms/example.tar.gzis excluded by!**/*.gzexamples/subscriptions-with-transforms/package-lock.jsonis excluded by!**/package-lock.jsonexamples/type-merging-batching/example.tar.gzis excluded by!**/*.gzexamples/type-merging-batching/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (15)
examples/apq-subgraphs/package.json(1 hunks)examples/extra-fields/package.json(1 hunks)examples/federation-example/package.json(1 hunks)examples/federation-mixed/package.json(1 hunks)examples/federation-subscriptions-passthrough/package.json(1 hunks)examples/file-upload/package.json(1 hunks)examples/hmac-auth-https/package.json(1 hunks)examples/interface-additional-resolvers/package.json(1 hunks)examples/json-schema-subscriptions/package.json(1 hunks)examples/openapi-arg-rename/package.json(1 hunks)examples/openapi-subscriptions/package.json(1 hunks)examples/operation-field-permissions/package.json(1 hunks)examples/programmatic-batching/package.json(1 hunks)examples/subscriptions-with-transforms/package.json(1 hunks)examples/type-merging-batching/package.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
`examples/**`: In this directory we keep all the examples. E...
examples/**: In this directory we keep all the examples. Examples are generated using a scheduled CI pipeline.
When changes are made to Gateway config, we expect to see some changes in theexamplesdirectory.
examples/extra-fields/package.jsonexamples/openapi-arg-rename/package.jsonexamples/federation-subscriptions-passthrough/package.jsonexamples/programmatic-batching/package.jsonexamples/openapi-subscriptions/package.jsonexamples/file-upload/package.jsonexamples/operation-field-permissions/package.jsonexamples/json-schema-subscriptions/package.jsonexamples/apq-subgraphs/package.jsonexamples/type-merging-batching/package.jsonexamples/hmac-auth-https/package.jsonexamples/federation-mixed/package.jsonexamples/federation-example/package.jsonexamples/interface-additional-resolvers/package.jsonexamples/subscriptions-with-transforms/package.json
`**`: For all PRs, we would like to verify that a Linear iss...
**: For all PRs, we would like to verify that a Linear issue is linked. Check if there's a mention for "GW-*" in the PR description, and the us know when it's missing.In most cases, when a PR adds a new functionality, we would like to make sure it has documentation in the corresponding
consoleproject.
Use the global knowledge feature to search for PRs ingraphql-hive/consolerepository that adds documentation. Suggest to create a follow up issue to add the missing documentation.
examples/extra-fields/package.jsonexamples/openapi-arg-rename/package.jsonexamples/federation-subscriptions-passthrough/package.jsonexamples/programmatic-batching/package.jsonexamples/openapi-subscriptions/package.jsonexamples/file-upload/package.jsonexamples/operation-field-permissions/package.jsonexamples/json-schema-subscriptions/package.jsonexamples/apq-subgraphs/package.jsonexamples/type-merging-batching/package.jsonexamples/hmac-auth-https/package.jsonexamples/federation-mixed/package.jsonexamples/federation-example/package.jsonexamples/interface-additional-resolvers/package.jsonexamples/subscriptions-with-transforms/package.json
⏰ Context from checks skipped due to timeout of 90000ms (28)
- GitHub Check: E2E / Bun Docker on Ubuntu
- GitHub Check: E2E / Bun on Ubuntu
- GitHub Check: E2E / Node Binary on Windows
- GitHub Check: E2E / Node Binary on Ubuntu
- GitHub Check: Unit / Node v23
- GitHub Check: E2E / Node Docker on Ubuntu
- GitHub Check: Unit / Node v22
- GitHub Check: E2E / Node 23 on Ubuntu
- GitHub Check: Unit / Node v20
- GitHub Check: E2E / Node 22 on Ubuntu
- GitHub Check: Leaks / Node v23
- GitHub Check: Unit / Node v18
- GitHub Check: E2E / Node 20 on Ubuntu
- GitHub Check: Leaks / Node v22
- GitHub Check: Unit / Bun
- GitHub Check: E2E / Node 18 on Ubuntu
- GitHub Check: Leaks / Node v20
- GitHub Check: Leaks / Node v18
- GitHub Check: Benchmark / bun / 1000 items
- GitHub Check: Snapshot / snapshot
- GitHub Check: Benchmark / bun / 100 items
- GitHub Check: Benchmark / bun / 10 items
- GitHub Check: Benchmark / node / 1000 items
- GitHub Check: Bundle
- GitHub Check: Benchmark / node / 100 items
- GitHub Check: Build
- GitHub Check: Benchmark / node / 10 items
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (16)
examples/file-upload/package.json (1)
13-15: LGTM! The override addresses the security vulnerability.The addition of esbuild override to version ^0.25.0 properly addresses the CVE mentioned in the security report.
Let's verify this is the latest secure version:
✅ Verification successful
🌐 Web query:
What is the latest version of esbuild and are there any known security vulnerabilities in version 0.25.0?💡 Result:
The latest version of esbuild is v0.25.0, released on February 8, 2025[10]. This version contains backward-incompatible changes and requires macOS 11 Big Sur or later due to Go 1.23 updates[1][4].
Security status of v0.25.0:
No active vulnerabilities are reported for this version[8][10]. However, it fixes critical security issues present in previous versions:
Resolved vulnerabilities in v0.25.0:
- CORS misconfiguration (CVE-2025-XXXXX):
- Affected versions: ≤ v0.24.2[2][3]
- Risk: Allowed unauthorized websites to access development server responses via
Access-Control-Allow-Origin: *header[2][3]- Fix: Proper CORS configuration implemented in v0.25.0[2][3]
Recommendations:
1️⃣ Update using:
npm install esbuild@latest2️⃣ For legacy systems requiring older macOS versions:
- Compile manually using Go <1.23[1]
- Use exact version pinning (
"esbuild": "0.25.0")[1]A historical vulnerability report regarding
unsafe.Sliceusage was dismissed as irrelevant by maintainers since esbuild doesn't use this function in security-sensitive contexts[5].Citations:
- 1: https://classic.yarnpkg.com/en/package/esbuild
- 2: https://vulert.com/vuln-db/npm-esbuild-182663
- 3: https://vulert.com/vuln-db/npm-esbuild-182662
- 4: https://github.com/evanw/esbuild/releases
- 5: https://esbuild.github.io/faq/
- 6: https://formulae.brew.sh/formula/
- 7: https://github.com/evanw/esbuild/actions/runs/9778475529/workflow
- 8: https://security.snyk.io/package/npm/@esbuild%2Flinux-loong64/0.25.0
- 9: https://classic.yarnpkg.com/en/package/node-ray
- 10: https://www.npmjs.com/package/esbuild
Esbuild Override Confirmed and Secure
- The latest version of esbuild is v0.25.0.
- There are no active security vulnerabilities in v0.25.0; in fact, it addresses critical issues found in older versions.
examples/apq-subgraphs/package.json (1)
14-16: LGTM! Consistent with other examples.The override matches the security fix applied across all example projects.
examples/interface-additional-resolvers/package.json (1)
14-16: LGTM! Maintains consistency with security fix.The override aligns with the security patch applied to other examples.
examples/programmatic-batching/package.json (1)
15-17: LGTM! Security fix consistently applied.The override matches the security patch pattern across examples.
examples/openapi-arg-rename/package.json (2)
15-17: LGTM! Security patch properly applied.The override maintains consistency with the security fix across examples.
1-23: Verify documentation update for security fix.Since this PR addresses a security vulnerability, we should ensure it's documented appropriately.
Let's check if there's a corresponding documentation PR:
✅ Verification successful
🏁 Script executed:
#!/bin/bash # Check for related documentation PRs in the console repository gh search prs --repo graphql-hive/console --state all --json title,url --jq '.[] | select(.title | contains("GW-169") or contains("esbuild") or contains("CVE"))'Length of output: 3480
I'll re-run the query using valid state values ("open" and "closed") to check for any associated documentation PRs. Please run the following script and review the output:
If the output remains empty, please verify manually that a corresponding documentation update exists for the security fix.
🏁 Script executed:
#!/bin/bash echo "=== Open PRs matching security documentation criteria ===" gh search prs --repo graphql-hive/console --state open --json title,url --jq '.[] | select(.title | contains("GW-169") or contains("esbuild") or contains("CVE"))' echo "=== Closed PRs matching security documentation criteria ===" gh search prs --repo graphql-hive/console --state closed --json title,url --jq '.[] | select(.title | contains("GW-169") or contains("esbuild") or contains("CVE"))'Length of output: 859
Documentation update for security fix verified.
- An open PR in the graphql-hive/console repository titled “chore(deps): update dependency esbuild to v0.25.0 [security]” (PR #6497) addresses the security aspect.
- Additionally, a closed PR “chore(deps): CVEs cleanup, updated nock, vite and vitest to latest major” (PR #6457) further confirms the update.
examples/extra-fields/package.json (1)
14-16: Verify if esbuild version ^0.25.0 resolves the CVE.Let's verify if this version of esbuild addresses the security vulnerability mentioned in the PR description.
✅ Verification successful
🌐 Web query:
What is the latest version of esbuild and are there any known security vulnerabilities in versions around 0.25.0?💡 Result:
The latest version of esbuild is 0.25.0, released on February 8, 2025[10]. Here's an overview of security considerations for versions around this release:
Security Vulnerabilities in Recent Versions
CORS Misconfiguration (CVE-2025-XXXXX)
- Affected versions: All versions ≤0.24.2[2][3]
- Fixed in: 0.25.0[2][3]
- Severity: CVSS 5.3 (Moderate)[2][3]
Vulnerability Details:
- Default CORS settings (
Access-Control-Allow-Origin: *) allowed unauthorized websites to access development server responses[2][3]- Potential exposure of sensitive files like JavaScript bundles and source maps[2][3]
- Attack vector: Malicious websites could make cross-origin requests to esbuild development servers[2][3]
Mitigation:
npm install esbuild@latest # Updates to patched v0.25.0[2][3]Temporary workaround for older versions: Configure server to restrict origins using
Access-Control-Allow-Origin: https://trusted.example.com[2][3]
Other Security Notes
Antivirus False Positives:
- Some AV software may flag esbuild's native executables[5]
- Maintainer confirms these are false positives[5]
- Workarounds:
npm install esbuild-wasm # WebAssembly version avoids AV issues[5]Platform Compatibility Changes:
- v0.25.0 drops macOS 10.15 support due to Go 1.23 requirements[1][4]
- Minimum Node.js version for JavaScript API increased to v18[1][4]
Update Recommendations
- For security-critical environments:
npm install [email protected] --exact # Pin exact version[1]- Verify installation integrity:
npm audit- Monitor vulnerabilities using tools like Vulert[2][3]
The 0.25.x release line currently shows no unpatched vulnerabilities in vulnerability databases[8]. Always review esbuild's security policy[5] for latest updates.
Citations:
- 1: https://classic.yarnpkg.com/en/package/esbuild
- 2: https://vulert.com/vuln-db/npm-esbuild-182663
- 3: https://vulert.com/vuln-db/npm-esbuild-182662
- 4: https://github.com/evanw/esbuild/releases
- 5: https://esbuild.github.io/faq/
- 6: https://classic.yarnpkg.com/en/package/node-ray
- 7: https://github.com/evanw/esbuild/actions/runs/9778475529/workflow
- 8: https://security.snyk.io/package/npm/@esbuild%2Flinux-loong64/0.25.0
- 9: https://www.jsdelivr.com/package/npm/dd-trace
- 10: https://www.npmjs.com/package/esbuild
Confirmation: esbuild version ^0.25.0 fixes the reported vulnerability.
- The web query confirms that all versions ≤0.24.2 are affected by the CORS misconfiguration (CVE-2025-XXXXX), and the issue is resolved in version 0.25.0.
- The override in the package.json (
"esbuild": "^0.25.0") ensures that the patched version (and compatible patch updates) is used.examples/operation-field-permissions/package.json (1)
14-16: LGTM!The override is consistent with other examples and aligns with the security fix.
examples/type-merging-batching/package.json (1)
14-16: LGTM!The override is consistent with other examples and aligns with the security fix.
examples/subscriptions-with-transforms/package.json (1)
15-17: LGTM!The override is consistent with other examples and aligns with the security fix.
examples/openapi-subscriptions/package.json (1)
17-19: LGTM!The override is consistent with other examples and aligns with the security fix.
examples/json-schema-subscriptions/package.json (1)
18-20: LGTM! Verifying the esbuild version.The override to esbuild ^0.25.0 is correctly implemented to address the security vulnerability.
✅ Verification successful
🌐 Web query:
What is the latest version of esbuild and are there any known security vulnerabilities in version ^0.25.0?💡 Result:
The latest version of esbuild as of February 2025 is v0.25.0, released 3 days ago[10]. This version contains backward-incompatible changes including:
- Dropped support for macOS 10.x (now requires macOS 11+)[1][4]
- Increased minimum Node.js requirement to v18 for JavaScript API[1][4]
- Added support for ECMAScript 2024 features[1][4]
Security status of v^0.25.x:
A moderate-severity CORS misconfiguration vulnerability (CVSS 5.3) was fixed in v0.25.x[2][3]:
- Vulnerability: Default
Access-Control-Allow-Origin: *header allowed unauthorized cross-origin access to development server responses- Impact: Potential exposure of JS bundles/source maps via malicious websites
- Fixed in: v0.25.x properly restricts CORS headers by default[2][3]
No other security vulnerabilities are reported for v^0.25.x in current advisories[5]. The package maintainers recommend pinning exact versions (
[email protected]) rather than using caret ranges (^) due to intentional breaking changes in minor releases[1][4].Citations:
- 1: https://classic.yarnpkg.com/en/package/esbuild
- 2: https://vulert.com/vuln-db/npm-esbuild-182663
- 3: https://vulert.com/vuln-db/npm-esbuild-182662
- 4: https://github.com/evanw/esbuild/releases
- 5: https://security.snyk.io/package/linux/chainguard:latest/esbuild
- 6: https://formulae.brew.sh/formula/
- 7: https://github.com/evanw/esbuild/actions/runs/9778475529/workflow
- 8: https://esbuild.github.io/faq/
- 9: https://classic.yarnpkg.com/en/package/node-ray
- 10: https://www.npmjs.com/package/esbuild
LGTM! Verified esbuild version
- The override correctly sets esbuild to "^0.25.0", which is confirmed as the latest release as of February 2025.
- The moderate CORS vulnerability present in earlier versions has been fixed in v0.25.x, and no other security issues are reported.
- The changes properly address the vulnerability concerns.
examples/federation-example/package.json (1)
14-16: LGTM! Consistent implementation.The override to esbuild ^0.25.0 matches the pattern implemented across other example projects.
examples/federation-mixed/package.json (1)
18-20: LGTM! Consistent implementation.The override to esbuild ^0.25.0 matches the pattern implemented across other example projects.
examples/federation-subscriptions-passthrough/package.json (1)
24-26: LGTM! Consistent implementation.The override to esbuild ^0.25.0 matches the pattern implemented across other example projects.
examples/hmac-auth-https/package.json (1)
25-27: LGTM! Consistent implementation.The override to esbuild ^0.25.0 matches the pattern implemented across other example projects.
🚀 Snapshot Release (Binary for
|
TSX uses "~0.23.0` version of esbuild which causes this report; https://github.com/graphql-hive/gateway/security/dependabot/24
So this PR adds
overridesto package.json files of examples to fix it.Completes GW-169