fix(security): replace adm-zip with node-stream-zip (CVE-2026-76845) [TE-27044] - #60
Open
rachit-lambdatest wants to merge 2 commits into
Open
Conversation
rachit-lambdatest
force-pushed
the
TE-27044-replace-adm-zip
branch
from
September 3, 2026 10:14
88a5b61 to
8f51eca
Compare
rachit-lambdatest
changed the title
rachit-lambdatest
force-pushed
the
TE-27044-replace-adm-zip
branch
3 times, most recently
from
September 3, 2026 11:32
2b781e8 to
59bf568
Compare
… extraction adm-zip@^0.6.0 is flagged HIGH (CVE-2026-76845 / SNYK-JS-ADMZIP-19276676) with no fixed release available. Replace it with the zero-dependency, advisory-clean node-stream-zip for unzipping the LambdaTest Tunnel binary in lib/tunnel_binary.js, preserving the chmod + callback/retry flow. Also refresh the lockfile so axios resolves to 1.20.0, clearing the remaining transitive advisories. Extraction verified byte-identical to adm-zip on the Mac/Windows/Linux binaries; npm audit --omit=dev reports 0 vulnerabilities. TE-27044 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
rachit-lambdatest
force-pushed
the
TE-27044-replace-adm-zip
branch
from
September 3, 2026 11:39
59bf568 to
2d1dd59
Compare
amathur-LT
approved these changes
Sep 3, 2026
Release the adm-zip -> node-stream-zip security fix (TE-27044). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
adm-zip@^0.6.0is flagged HIGH (CVE-2026-76845 / SNYK-JS-ADMZIP-19276676) with no fixed release available. This replaces it with the zero-dependency, advisory-cleannode-stream-zip@^1.16.0for extracting the downloaded LambdaTest Tunnel binary.Jira: TE-27044
Change
package.json:adm-zip@^0.6.0→node-stream-zip@^1.16.0.lib/tunnel_binary.js(download_):new AdmZip(...).extractAllTo(dir, false)→new StreamZip.async({ file }).extract(null, dir), preserving the existingchmod 0755+ callback/retry flow.package-lock.json: refreshed (also resolvesaxiosto1.20.0, clearing transitiveform-dataadvisories).Verification
npm audit --omit=devreports 0 vulnerabilities; no remainingadm-zipreferences.🤖 Generated with Claude Code