fix(deps): Dependabot security bumps — baileys (critical) + 7 more (DAN-1385) - #26
Merged
Merged
Conversation
…N-1385) Clears Dependabot #84 (@babel/core sourceMappingURL file-read, low) and a moderate brace-expansion vuln. Build verified. Co-Authored-By: Claude <noreply@anthropic.com>
….10 (DAN-1385) Clears Dependabot #51 (joi recursive link() RangeError, moderate) and #89 (http-proxy-middleware Host-header dispatch bypass, moderate). Both are patch bumps within Docusaurus's existing major range. Docusaurus build verified (exit 0). Residual: #86 js-yaml (moderate DoS) via gray-matter → @docusaurus/utils. gray-matter 4.0.3 (latest) pins js-yaml ^3 and uses the 3.x safeLoad API, so js-yaml 3.14.2 has no in-range fix (forcing 4.x would break gray-matter). The 4.x js-yaml copies are already at 4.2.0 (fixed). Accepted: moderate DoS requiring a malicious YAML input; Docusaurus only parses trusted local docs. Co-Authored-By: Claude <noreply@anthropic.com>
….0→7.6.4 (DAN-1385) Clears Dependabot #43 (baileys CRITICAL: message upsert / hist-sync spoofing + app-state corruption via malicious protocolMessage), #59 (protobufjs DoS via unbounded Any expansion), and #58 (protobufjs schema-name shadowing). baileys: switch from git-commit pin (WhiskeySockets/Baileys#01047debd8, which resolved to 7.0.0-rc.9 — vulnerable) to npm 7.0.0-rc13 (latest dist-tag, fixed in >=rc12). protobufjs override raised ^7.5.5 -> ^7.6.3 (resolves to 7.6.4). npm audit: 0 vulnerabilities. Verified: bridge starts with a throwaway session dir + non-default port, imports baileys cleanly, connects to WhatsApp servers, and reaches the QR pairing stage ("Waiting for scan..."). baileys API (makeWASocket / useMultiFileAuthState / fetchLatestBaileysVersion) is compatible with rc13. Full live message round-trip on the real session requires deploy + pairing + watching the live bot (not done here — this is a live WhatsApp service). Co-Authored-By: Claude <noreply@anthropic.com>
🔎 Lint report:
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Dependabot security-bump batch for DAN-1385 (dep-bump portion). 8 alerts cleared, 1 documented residual, 2 code-level alerts (#93 DNS rebinding, #94 file perms) handled separately.
Bumps (per subpackage)
scripts/whatsapp-bridge(the live WhatsApp bridge):@whiskeysockets/baileys7.0.0-rc.9 → 7.0.0-rc13 (npm) — clears fix(mem0): scope prefetch search and result cache by user_id #43 CRITICAL (message upsert / hist-sync spoofing + app-state corruption). Switched from a git-commit pin (#01047debd8, which resolved to rc.9 — vulnerable) to the npm latest dist-tag (fixed in ≥rc12).protobufjs7.6.0 → 7.6.4 (override^7.5.5→^7.6.3) — clears feat: launchd plist uses gateway-wrapper.sh as entrypoint with self-healing fallback (DAN-1491) #59 (DoS via unbounded Any expansion) + fix(ci): cap healer reruns globally via run_attempt check #58 (schema-name shadowing).makeWASocket/useMultiFileAuthState/fetchLatestBaileysVersion) compatible with rc13.ui-tui: esbuild 0.27.7→0.28.1 (direct) + tsx 4.21→4.22.4 (pulls esbuild 0.28 natively, dedupes nested vuln) — clears #46 (esbuild) + #61 (@babel/core). Build verified.web: @babel/core + brace-expansion vianpm audit fix— clears #84 (@babel/core). Build verified.website(Docusaurus 3.10.1): overridesjoi→17.13.4 +http-proxy-middleware→2.0.10 — clears #51 (joi) + #89 (http-proxy-middleware). Docusaurus build verified (exit 0).Residual (accepted, documented)
gray-matter→@docusaurus/utils. gray-matter 4.0.3 (latest) pins js-yaml^3and uses the 3.xsafeLoadAPI; js-yaml 3.x has no fix (3.14.2 is the last 3.x). Forcing js-yaml 4.x would break gray-matter. The 4.x js-yaml copies are already at 4.2.0 (fixed). Accepted: moderate DoS requiring a malicious YAML input; Docusaurus only parses trusted local docs. Would need an upstream gray-matter js-yaml-4 release to clear.Still open (separate PR — code fixes, not dep bumps)
response_store.db+webhook_subscriptions.jsoncreated world-readable (0o644) — hermes-agent core source.npm auditper subpackage: 0 vulnerabilities (except the documented js-yaml residual in website).Fixes DAN-1385 (dep-bump portion)
🤖 Generated with Claude Code