Clear OSV-Scanner HIGH/MED/LOW findings via dep bumps + overrides#390
Open
vikrantpuppala wants to merge 1 commit into
Open
Clear OSV-Scanner HIGH/MED/LOW findings via dep bumps + overrides#390vikrantpuppala wants to merge 1 commit into
vikrantpuppala wants to merge 1 commit into
Conversation
Surfaced by OSV-Scanner against package-lock.json. The pre-change scan reported 22 HIGH / 15 MED / 5 LOW (42 total). After this PR a clean scan against the new lockfile reports 0 HIGH / 0 MED / 1 LOW (the single remaining LOW is GHSA-73rr-hh4g-fpgx on diff@7.0.0, pinned by sinon@19.0.5 — not overridable without breaking sinon's peer ranges, and is reachable only via assertion-error rendering in test code). Top-level bumps (runtime): thrift 0.16.0 -> 0.23.0 GHSA-r67j-r569-jrwp, GHSA-526f-jxpj-jmg2 (both HIGH) Top-level bumps (devDependencies): mocha 10.2.0 -> 10.8.2 eslint 8.22.0 -> 8.57.1 eslint-plugin-import 2.26.0 -> 2.32.0 sinon 17.0.1 -> 19.0.5 @types/node-fetch 2.6.4 -> 2.6.13 `overrides` block added for deep transitives that can't be reached by top-level bumps (basic-ftp via proxy-agent chain; @75lb/deep-merge via apache-arrow chain; ws pinned inside thrift; cross-spawn pinned inside eslint; etc.). Each override is set to the lowest version that clears its CVEs to minimize unintended behavior changes. Test-stub follow-ups (required by the dev-dep bumps' newer types): - OAuthCallbackServerStub: add Symbol.asyncDispose stub method (newer @types/node added it to http.Server). - Issuer stub in OAuthManager.test: add FAPI2Client property (openid-client >= 5.5 widened the interface). - AuthorizationCode.test: cast sinon.spy result to `as any` for the private-field assignment (the stub intentionally doesn't fully mirror http.Server; runtime is identical). Net OSV-Scanner result after this PR: HIGH: 22 -> 0 MED: 15 -> 0 LOW: 5 -> 1 (sinon-pinned, documented in PR description) Verified locally: npm run build -- clean npm run type-check -- clean (no errors in lib/ or tests/) npm run lint -- 3 pre-existing warnings, no errors Co-authored-by: Isaac Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
vikrantpuppala
had a problem deploying
to
azure-prod
GitHub Actions
Failure
vikrantpuppala
had a problem deploying
to
azure-prod
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps deps and adds
package.jsonoverridesto clear all HIGH and MED OSV-Scanner findings against the currentpackage-lock.json. Companion to #388 (the security workflow PR).Top-level bumps
thriftmochaeslinteslint-plugin-importsinon@types/node-fetchoverridesfor deep transitivesPackages reachable only via deep dependency chains where no top-level bump applies. Each is pinned to the lowest version that clears its CVEs:
Net OSV-Scanner result
The single remaining LOW is
GHSA-73rr-hh4g-fpgxondiff@7.0.0, pinned bysinon@19.0.5. Can't be overridden without breaking sinon's peer ranges (sinon requiresdiff@^7and the fix is indiff@8.0.3+which sinon hasn't accepted yet). Reachable only via sinon's assertion-error rendering in test code — never runtime. Recommended to add a documented[[IgnoredVulns]]entry for it inosv-scanner.toml(this happens in #388's scope, not here).Test-stub follow-ups required by the bumps
A few test stubs needed updates because
@types/nodeandopenid-clientinterfaces grew in the newer versions transitively pulled in by the dev-dep bumps:tests/unit/.stubs/OAuth.ts: added[Symbol.asyncDispose]()stub onOAuthCallbackServerStub—@types/node ≥ 18.19added it tohttp.Server.OAuthManager.test.ts: addedFAPI2Clientto the issuer stub — openid-client ≥ 5.5 widened theIssuerinterface.AuthorizationCode.test.ts: cast thesinon.spyassignment toas anyfor the private-field write. The stub intentionally doesn't fully mirrorhttp.Server; runtime is identical.No Node.js engine bump
Despite eslint/typescript-eslint declaring
>=16ranges, all of them ship versions that accept Node 14.17+. The repo's CI matrix[14, 16, 18, 20]continues to work without changes.package.jsonengines.node: ">=14.0.0"is also unchanged.Test plan
npm run buildcleannpm run type-checkclean (no errors inlib/ortests/)npm run lint— 3 pre-existing warnings, no errorsThis pull request was AI-assisted by Isaac.