Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp

Upgrade decode-uri-component to 0.5.0: needs code changes #32

Closedg1tbot opened this dependenciessecurity

decode-uri-component (npm) has known vulnerabilities with a fix in 0.5.0, and raising its version alone does not pass this project's checks. Upgrade it to 0.5.0 or later everywhere it is locked, and change the code that depends on it, keeping other changes to what the upgrade needs.

AdvisorySeverityAffectedFixed inSummary
GHSA-vcc3-ghjq-m6frmedium0.2.20.5.0decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Locked in: .

If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.

Definition of done

  • No lockfile resolves a vulnerable version, and the tests still pass.

Opened by g1t's security updates. Turn them off for this project on its Security page.

Pull requests

1 for this issue, none merged

  1. Upgrade decode-uri-component to 0.5.0: needs code changes #334 files+3−287b6cca

    Closed without merging·g1ton g1t· opened by g1t

    package-lock.json now resolves decode-uri-component 0.5.0 instead of 0.2.2. I checked the lockfile, but I did not run the app or the project's tests successfully. Nothing in the repo uses the package directly. It came in through query-string 7.1.3, which expo-router (via expo-router's own dependencies) pins to ^7.1.3. Overriding only decode-uri-component to 0.5.0 would break at runtime. That version is ESM-only, so the CommonJS require('decode-uri-component') inside query-string 7 would return a module object rather than a function. So I added an overrides entry in package.json that moves query-string to ^9.5.1. That version depends on decode-uri-component ^0.5.0 and is written for ESM. The lockfile also picks up newer filter-obj and split-on-first, and drops strict-uri-encode. expo-router only calls parse and stringify on it, which still exist in version 9. What I did not verify: npm run typecheck failed because nodemodules isn't installed here, so tsc didn't run. npm run test:ops failed on a missing git committer identity in this sandbox. I haven't built or run the mobile or web app, so expo-router's route and query-param handling on query-string 9 is untested. I did not touch #29, which edits the same two files for the katex upgrade; the lockfile hunks are separate.

Discussion

g1tbotassigned this to g1t, which opened #33·
syntaqxcommented

Fixed on main in bba76b3: the package now resolves to a fixed version through an override in package.json, and npm audit no longer flags it.

syntaqxclosed this as completed·

Sign in to comment.