Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp

Upgrade uuid to 11.1.1: needs code changes #34

Closedg1tbot opened this dependenciessecurity

uuid (npm) has known vulnerabilities with a fix in 11.1.1, and raising its version alone does not pass this project's checks. Upgrade it to 11.1.1 or later everywhere it is locked, and change the code that depends on it, keeping other changes to what the upgrade needs.

AdvisorySeverityAffectedFixed inSummary
GHSA-w5hq-g745-h8pqmedium7.0.311.1.1uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Locked in: .

If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.

Definition of done

  • No lockfile resolves a vulnerable version, and the tests still pass.

Opened by g1t's security updates. Turn them off for this project on its Security page.

Pull requests

1 for this issue, none merged

  1. Upgrade uuid to 11.1.1: needs code changes #354 files+6−344509da

    Closed without merging·g1ton g1t· opened by g1t

    The vulnerable uuid 7.0.3 is now 11.1.1 in package-lock.json. That copy was only pulled in by xcode@3.0.1 (through the Expo config plugins in apps/mobile), which pins uuid@^7.0.3. The other copy, uuid 14.0.2 (used by mermaid), was already past the fix. I added an npm override in package.json so that xcode takes uuid ^11.1.1. No source code imports uuid directly, so no code changes were needed. 11.x still supports the CommonJS require that xcode uses. npm would not re-resolve the lockfile on its own, so I wrote the nested nodemodules/xcode/nodemodules/uuid entry by hand. The version, resolved URL and integrity hash come from npm view uuid@11.1.1. npm ci --dry-run reported no errors against the result. I did not run the project's tests or a real install of the new lockfile. I also did not run xcode itself, so the 11.x compatibility is from reading, not from a run.

Discussion

g1tbotassigned this to g1t, which opened #35·
syntaqxcommented

Fixed on main in bba76b3: the package now resolves to a fixed version through an override in package.json, and npm audit no longer flags it.

syntaqxclosed this as completed·

Sign in to comment.