{{ message }}
Repository navigation
Conversation
pnpm audit --prod flagged 35 advisories (16 high, 17 moderate, 2 low). None had a working exploit path in current code (verified per-case in the changeset), but several close real vectors: - drizzle-orm 0.38.2 -> 0.45.2 (GHSA-gpj5-g38j-94v9, SQLi via sql.identifier()/.as() — confirmed unused in this codebase) - nodemailer 6.9.16 -> 9.0.5 (high-severity raw-option bypass of disableFileAccess/disableUrlAccess — confirmed smtp adapter never sets `raw`); @types/nodemailer -> ^8.0.1 (newest published) - next 16.2.10 -> 16.2.11 (4 moderate: UTF-8 DoS, unbounded Server Action payload, SVG DoS, internal endpoint disclosure) - pnpm-workspace.yaml overrides for transitive pins: multer, body-parser, postcss, file-type, qs Deliberately excluded: @nestjs/core (GHSA-36xv-jgw5-4q75) needs a v10->v11 major bump, out of scope here — tracked separately. Audit goes from 35 findings to that one documented exception. build:packages, typecheck, and test (979 tests, 16/16 turbo tasks) all pass unchanged.
Contributor
17 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ran
pnpm audit --prodagainst the dependency tree as part of an informal security review. It flagged 35 advisories (16 high, 17 moderate, 2 low) across direct and transitive dependencies. This PR patches all but one.None of these had a working exploit path in the current codebase — I checked each one against actual usage before bumping, rather than bumping blind. Details per package below. The point of the PR is preventive: closing vectors that a future, unrelated change could reopen.
Changes
drizzle-orm0.38.2 → 0.45.2 — closes GHSA-gpj5-g38j-94v9, a SQL injection viasql.identifier()/.as(). Grepped the codebase: neither is called anywhere, so this wasn't reachable today — patched preventively.nodemailer6.9.16 → 9.0.5** — closes several advisories, the highest-severity being a bypass where therawsendMail option ignoresdisableFileAccess/disableUrlAccess.packages/notifications/src/adapters/smtp.tsonly sets standard message fields, neverraw.@types/nodemailerbumped to^8.0.1(the newest published; nodemailer 9.x ships no bundled types yet) —build:packages` compiles clean against it.next16.2.10 → 16.2.11 — closes four moderate advisories: DoS via invalid UTF-8 request bodies, unbounded Server Action payload size, SVG image-optimization DoS, and disclosure of an internal Server Function endpoint.pnpm-workspace.yamloverrides(the direct dependency —@nestjs/platform-expressornext— hasn't bumped its own range yet, each entry cites the advisory it closes):multer >=2.2.0,body-parser >=1.20.6,postcss >=8.5.23,file-type >=21.3.2,qs >=6.15.2. Mostly DoS-class issues in request/body parsing and file-type sniffing.onlyBuiltDependenciesfrom rootpackage.jsontopnpm-workspace.yaml(pnpm 10.x deprecated reading it frompackage.json— was throwing a warning on every install, unrelated to the CVEs but fixed while touching this file).Deliberately out of scope
@nestjs/core(GHSA-36xv-jgw5-4q75, needs>=11.1.18) is still open. Fixing it means a NestJS v10 → v11 major upgrade, which is a different, higher-risk change than a dependency patch bump. Left it as the one remainingpnpm audit --prodfinding rather than bundling a framework major into this PR — happy to open that as a separate PR if useful.Testing
pnpm run build:packages— 7/7 packages, cleanpnpm run typecheck— 16/16 turbo tasks, cleanpnpm run test— 979 tests (188 db + 431 web + 360 api), all greenpnpm audit --prod— 35 findings → 1 (the documented@nestjs/coreexclusion above)🤖 Generated with Claude Code