Repository navigation
fix: Patch all open advisories in the activity UI - #294
Merged
Merged
Conversation
The UI workspace lockfile resolved packages carrying 3 critical and 54 high pnpm audit advisories, among them DOMPurify XSS bypasses in the datum-ui and monaco-editor copies the example app bundles, a proxy-addr trust bypass in its Express server, and a tar path-traversal chain in its Remix tooling. The published library keeps these as peers, so consumers resolve their own copies. Key changes: - Example app Remix ranges raised to ^2.17.5 and js-yaml to ^4.3.2 - In-range lockfile refresh of dompurify 3.4.17, proxy-addr 2.0.8, body-parser 1.20.9, compression 1.8.2, path-to-regexp 0.1.13, brace-expansion 1.1.21 and 2.1.7, browserslist 4.29.4, flatted 3.4.4, js-yaml 4.3.2, lodash 4.18.1, picomatch 2.3.2 and 4.0.7, undici 6.29.1 and 8.12.3, ws 7.5.13 - Scoped overrides for parents that pin a vulnerable version: monaco-editor>dompurify ^3.4.17, typescript-estree>minimatch ^9.0.9, cacache>tar ^7.5.21 (cacache ships tar without loading it), and remark-mdx-frontmatter>toml ^5.0.1 (same parse API) - zod leaves the lockfile. It was only an optional datum-ui peer that neither the library nor the example imports. Three highs remain, all in the example app, which also ships as the activity UI container image: - turbo-stream 2.4.1, pinned exactly by Remix 2 with the fix only in 3.x. The advisory needs Single Fetch, which the example leaves off. - vite 5.4.21 (two advisories), the example's dev server, with no patched 5.x. Remix 2.17.5 accepts vite 6, so ^6.4.4 is the follow-up. vite is a dev dependency and stays out of the image.
ecv
force-pushed
the
fix/ui-security-advisories
branch
from
October 25, 2026 00:29
6f0ab82 to
c071331
Compare
ecv
marked this pull request as ready for review
October 25, 2026 03:38
ecv
enabled auto-merge
October 25, 2026 03:38
The activity UI example app still resolved packages behind medium and low Dependabot alerts, plus the vite 5 highs the previous commit left open. The published library is unaffected; consumers resolve their own copies of its peers. Key changes: - Example app vite raised to ^6.4.4, which Remix 2.17.5 accepts; the vite 5 line has no patched release - Scoped overrides raise @babel/core, estree-util-value-to-estree, morgan, postcss-selector-parser, qs, react-router, react-router-dom, valibot, vite and yaml to their patched releases - esbuild forced to ^0.25.0 because Remix pins 0.17.6 exactly react-router 6.30.6 stays: two advisories are patched only in 7.18, and Remix 2 cannot run on react-router 7.
ecv
changed the title
ecv
added a commit
that referenced
this pull request
Oct 25, 2026
The UI container image fails to build on Dependabot's vite and postcss bump (#207), so those security updates cannot merge. This PR lands the same bump with a lockfile that matches the manifest. The UI install, library build and example build all pass locally on vite 6.4. Supersedes #207. Its lockfile did not match its manifest, so the frozen install in the image build rejected it. Versions stay at the bot's targets: vite ^6.4.2 and postcss ^8.5.10, both in the example app only. #294 also edits the UI manifest and lockfile (different dependencies). Whichever lands second needs a lockfile regeneration.
scotwells
previously approved these changes
Oct 25, 2026
…ories # Conflicts: # ui/example/package.json # ui/pnpm-lock.yaml
kevwilliams
reviewed
Oct 26, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
Hold: the merge from main reverted the UI lockfile, so 2 of the 3 criticals stay open in the shipped image.
- At a81314c, ui/pnpm-lock.yaml resolves proxy-addr 2.0.7 and keeps a dompurify 3.4.15 copy; undici 6.23.0, lodash 4.17.23 and ws 7.5.10 also went back. Commit 3526a32 had proxy-addr 2.0.8, undici 6.29.1, lodash 4.18.1 and ws 7.5.13.
- Fix: regenerate the lockfile on the merged head so it honours the overrides block.
The merge from main reverted ui/pnpm-lock.yaml, so the shipped image went back to proxy-addr 2.0.7, a second dompurify 3.4.15 copy, and older undici, lodash and ws, reopening 2 of the 3 critical advisories this PR closes. Key changes: - Restore the lockfile from the advisory fix and reconcile it with the merged package files - proxy-addr 2.0.8, undici 6.29.1, lodash 4.18.1, ws 7.5.13 and a single dompurify 3.4.17; pnpm audit reports no critical advisories
kevwilliams
approved these changes
Oct 26, 2026
kevwilliams
left a comment
kevwilliams
left a comment
Contributor
There was a problem hiding this comment.
Verified the only change since the hold is ui/pnpm-lock.yaml, which now resolves proxy-addr 2.0.8, undici 6.29.1 and 8.12.3, lodash 4.18.1, ws 7.5.13 and a single dompurify 3.4.17.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The activity UI carried 112 open Dependabot alerts (3 critical, 37 high, 56 medium, 16 low). This PR clears all but 2 medium ones by moving the lockfile and example app to patched releases. The published component library keeps these packages as peers, so the exposure sits in the example app, which also ships as the activity UI container image, and in the dev toolchain. It supersedes Dependabot PRs #207 and #218; #218 bumped Go modules that have no open alert.
Packages
The earlier commit on this branch (dompurify, proxy-addr, tar, undici, js-yaml, lodash, ws, toml and the other critical and high fixes) is unchanged.
Remaining
2 medium alerts on react-router 6.30.6, an open redirect in
<Link>and an SSR hydration flaw, are patched only in react-router 7.18. Remix 2 cannot run on react-router 7 (the example build fails with it), so these wait for the example to move to React Router 7.Test plan