chore(deps): remediate shell-quote and js-yaml, hold TS 7 and better-sqlite3 13 - #1927
Merged
Conversation
…sqlite3 13 Security remediation for two alerts that Dependabot cannot fix on its own, because its security PRs always target the default branch (`main`), which requires the `Require head branch == beta` check: - shell-quote 1.8.4 -> 1.9.0 (GHSA: quadratic-complexity DoS in parse(), high, dev-only). Fixed upstream rather than via an override: concurrently pinned shell-quote at exactly 1.8.4, and concurrently 10.0.4 depends on 1.9.0. Supersedes #1869. - js-yaml 4.2.0 -> 4.3.0 (YAML merge-key chains force quadratic CPU, high, dev-only). The root `overrides` entry was pinning the vulnerable version, so the bump has to happen there. All consumers accept ^4.1.0. The nested gray-matter override stays at 3.15.0 — 3.x is outside the vulnerable range (>= 4.0.0, < 4.3.0). Dependabot ignore rules for two majors that are known-broken here: - typescript: ts-jest@29.4.x declares `peer typescript@">=4.3 <7"`, so the TS 7 bump makes `npm ci` fail with ERESOLVE and takes the entire dev-dependencies group down with it (#1882). - better-sqlite3: v13 dropped `prebuild-install` and always compiles from source; the Dockerfile `deps` stage ships no python3/build-base (#1889). `npm audit` goes from 10 findings (6 high) to 7 (3 high). The remainder are not fixable here: brace-expansion is bundled inside the `npm` package (dev-only, not overridable) and react-router's advisory is RSC-mode-only, which this BrowserRouter SPA does not use.
This was referenced Aug 2, 2026
Contributor
|
🎉 This PR is included in version 2.13.0-beta.40 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
steilerDev
added a commit
that referenced
this pull request
Aug 2, 2026
Corrects #1927, which held better-sqlite3 at 12.x on the incorrect premise that v13 always compiles from source. - v13 moved to N-API and ships prebuilds INSIDE the npm tarball, including linuxmusl-x64 and linuxmusl-arm64 — both Docker target arches are covered. - #1889's Docker failure was only that npm synthesizes `node-gyp rebuild` (binding.gyp present), and node-gyp needs python3 to evaluate gyp even though binding.gyp short-circuits to `type: 'none'` when a prebuild exists. Nothing was ever going to compile. - Fix: `npm ci --omit=dev --ignore-scripts` in the deps stage — better-sqlite3 is the only production dep with an install script, and it needs none (lib/binding.js resolves the prebuild at require() time). Keeps the image toolchain-free. - Adds a build-time guard so a missing prebuild fails the build instead of crashing production at runtime. - Removes the better-sqlite3 semver-major ignore rule; the typescript hold stays. Verified: linuxmusl-arm64 locally (loads and queries inside the Alpine image), linuxmusl-x64 in CI's Docker job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the two security alerts Dependabot structurally cannot fix, and adds ignore rules for two majors that are known-broken in this repo.
Security remediation
shell-quoteparse()(CWE-407), high, dev-onlyjs-yamlWhy Dependabot couldn't do this: its security PRs ignore
target-branch: betaand always open against the default branch (main), which requires theRequire head branch == betacheck. #1869 was unmergeable for that reason alone.shell-quoteis fixed upstream rather than by an override:concurrentlypinned it at exactly1.8.4, andconcurrently10.0.4 depends on1.9.0. Supersedes chore(deps): bump shell-quote and concurrently #1869.js-yamlhad to change in the rootoverridesblock — that entry was itself pinning the vulnerable 4.2.0, which is why the alert never cleared. All consumers accept^4.1.0. The nestedgray-matteroverride stays at 3.15.0 (3.x is outside the vulnerable>= 4.0.0, < 4.3.0range).Dependabot ignore rules
Both follow the existing
@babel/*hold pattern, with the reason and the removal condition in a comment:typescriptmajors —ts-jest@29.4.xdeclarespeer typescript@">=4.3 <7". The TS 7 bump makesnpm cifail withERESOLVEand takes the whole 19-package dev-dependencies group down with it (chore(deps-dev): bump the dev-dependencies group across 1 directory with 19 updates #1882). Remove once ts-jest widens its peer range.better-sqlite3majors — v13 removedprebuild-install; its install script is now a barenode-gyp rebuild, so it always compiles from source. The Dockerfiledepsstage deliberately ships nopython3/build-baseand runs on the target platform (chore(deps): bump the prod-dependencies group across 1 directory with 14 updates #1889). Remove once the image has a build toolchain.Note
Dependabot reads its config from the default branch, so both ignore rules only take effect once
betais promoted tomain— same caveat as the existing@babel/*holds.Audit impact
npm audit: 10 findings (6 high) → 7 (3 high). The remainder are not fixable here:brace-expansion— only node isnode_modules/npm/node_modules/brace-expansion, bundled inside thenpmpackage (dev-only, not overridable).react-router— the advisory is an RSC-mode CSRF bypass; this app uses a plainBrowserRouterSPA with no RSC, and the patch is a v8 major. Not worth the upgrade for an unreachable code path.Test plan