diff --git a/AUDIT.md b/AUDIT.md index 0f4a68517..e7a4a9e0b 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -1828,23 +1828,26 @@ WorldScript Studio was assessed as a strong, modern React/TypeScript application ## Known Overrides Table (Supply-Chain Hardening) Source of truth for the override floors is `pnpm-workspace.yaml` (`overrides:`). Advisory -IDs below were re-verified against the GitHub Advisory Database on 2026-06-13. Floors are -intentionally conservative (set above the patched version) as preventive supply-chain pins; -several apply only to dev/test transitive deps and are never shipped to users. +IDs below were re-verified against the GitHub Advisory Database on 2026-06-13, except the +`@xmldom/xmldom`, `fast-uri`, and `qs` rows, re-verified 2026-09-02 (Dependabot alert #79 +and two `pnpm audit` sweeps) after all three floors were found to no longer exclude the +then-currently-resolved vulnerable version. Floors are intentionally conservative (set at or +above the patched version) as preventive supply-chain pins; several apply only to dev/test +transitive deps and are never shipped to users. | Package | Override | Advisory | Justification | |---------|----------|----------|---------------| | esbuild | >=0.28.1 | GHSA-67mh-4wv8-2f99 | Dev-server CORS let any website send requests to the esbuild dev server and read the response (≤0.24.2; fixed 0.25.0). Build-tool only, never shipped. Pinned in the 2026-06 security merge. | | serialize-javascript | >=7.0.3 | GHSA-76p7-773f-r4q5 / CVE-2024-11831 | Regex XSS in serialized output (<6.0.2). | | tmp | ^0.2.6 | GHSA-52f5-9888-hmc6 / CVE-2025-54798 | Arbitrary temp file/dir write via symlink `dir` parameter (≤0.2.3; fixed 0.2.4). | -| @xmldom/xmldom | >=0.8.13 | GHSA-5fg8-2547-mr8q / CVE-2022-39353 | Misinterpretation of malicious XML input; floor sits above the 0.8.x fixes. | +| @xmldom/xmldom | >=0.9.12 | GHSA-6gmq-8vp8-gcm6 / CVE-2026-83610 (supersedes GHSA-5fg8-2547-mr8q / CVE-2022-39353) | XML fragment injection via invalid `EntityReference.nodeName` during `requireWellFormed` serialization (≥0.9.0 ≤0.9.11; fixed 0.9.12). The prior `>=0.8.13` floor no longer excluded this — Dependabot alert #79, 2026-09-02. Ships via `mammoth` (`.docx` export), a production dependency. | | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). | | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. | | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. | -| fast-uri | >=3.1.2 | GHSA-q3j6-qgpj-74h6 / CVE-2026-6321 | Path traversal via percent-encoded dot segments (≤3.1.0). | +| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed at or above 3.1.6). The prior `>=3.1.5` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. | | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). | | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). | -| qs | >=6.15.2 | GHSA-hrpp-h998-j3pp / CVE-2022-24999 | Prototype pollution / DoS via crafted query strings (fixed in the ≥6.2.4 line). | +| qs | >=6.16.0 | GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx (supersedes GHSA-hrpp-h998-j3pp / CVE-2022-24999) | Array-limit bypass via bracket-key comma parsing, and a DoS via attacker-controlled `isBuffer` (resolved 6.15.2 vulnerable; fixed 6.16.0). Dev-only transitive (`@lhci/cli`, `@stryker-mutator/core`, `http-server`), never shipped. `6.16.0` was published 2026-08-29, inside this repo's 7-day `minimumReleaseAge` quarantine at the time of this fix — admitted via a version-scoped `minimumReleaseAgeExclude: qs@6.16.0` entry (same mechanism/precedent as `nanoid@3.3.18`, PR #362), **not** a reduction of the 10080-minute quarantine itself. Compensating verification before admission: registry identity/integrity confirmed via `npm view`; no new install/preinstall/postinstall/prepare lifecycle scripts versus 6.15.2 (identical script set); the one dependency delta (`es-define-property@^1.0.1` added, `side-channel` bumped to `^1.1.1`) is maintained by the same author (`ljharb`) as `qs` itself and was already present elsewhere in the resolved tree. Remove the exclusion once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and a frozen install still resolves it — future qs releases remain governed by the normal quarantine. | | chrome-launcher | ^1.2.1 | preventive pin — no direct advisory | Lighthouse-CI dev transitive; conservative floor, dev-only. | | ip-address | >=10.1.1 | preventive pin — no direct advisory | Dev/test transitive hardening; no advisory matches this floor. | | uuid | >=11.1.1 | preventive pin — no direct advisory | Conservative version floor; no security advisory applies (the prior "collision" note was inaccurate). | diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 912783801..3e2a20c8e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,17 +13,17 @@ overrides: serialize-javascript: '>=7.0.3' chrome-launcher: ^1.2.1 tmp: '>=0.2.7' - '@xmldom/xmldom': '>=0.8.13' + '@xmldom/xmldom': '>=0.9.12' protobufjs: '>=8.6.6' axios: '>=1.18.0' basic-ftp: '>=5.3.1' - fast-uri: '>=3.1.5 <4' + fast-uri: '>=3.1.6 <4' ip-address: 10.3.1 ws: '>=8.21.0' form-data: '>=4.0.6' brace-expansion: '>=5.0.9' uuid: '>=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1' - qs: '>=6.15.2' + qs: '>=6.16.0' dompurify: '>=3.4.13' '@babel/core': '>=7.29.6 <8' undici: '>=7.29.0 <8' @@ -3490,10 +3490,9 @@ packages: '@workflow/serde@4.1.0': resolution: {integrity: sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ==} - '@xmldom/xmldom@0.9.10': - resolution: {integrity: sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==} + '@xmldom/xmldom@0.9.12': + resolution: {integrity: sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==} engines: {node: '>=14.6'} - deprecated: this version has critical issues, please update to the latest version '@xstate/react@6.1.0': resolution: {integrity: sha512-ep9F0jGTI63B/jE8GHdMpUqtuz7yRebNaKv8EMUaiSi29NOglywc2X2YSOV/ygbIK+LtmgZ0q9anoEA2iBSEOw==} @@ -4634,8 +4633,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.6: + resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} fast-wrap-ansi@0.2.0: resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==} @@ -6403,8 +6402,8 @@ packages: pure-rand@7.0.1: resolution: {integrity: sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==} - qs@6.15.2: - resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} + qs@6.16.0: + resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} engines: {node: '>=0.6'} queue-microtask@1.2.3: @@ -10802,7 +10801,7 @@ snapshots: '@workflow/serde@4.1.0': {} - '@xmldom/xmldom@0.9.10': {} + '@xmldom/xmldom@0.9.12': {} '@xstate/react@6.1.0(@types/react@19.2.18)(react@19.2.8)(xstate@5.32.5)': dependencies: @@ -10849,14 +10848,14 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -11137,7 +11136,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.15.2 + qs: 6.16.0 raw-body: 2.5.3 type-is: 1.6.18 unpipe: 1.0.0 @@ -11993,7 +11992,7 @@ snapshots: parseurl: 1.3.3 path-to-regexp: 0.1.13 proxy-addr: 2.0.7 - qs: 6.15.2 + qs: 6.16.0 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.2(supports-color@10.2.2) @@ -12044,7 +12043,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.6: {} fast-wrap-ansi@0.2.0: dependencies: @@ -13555,7 +13554,7 @@ snapshots: mammoth@1.12.1: dependencies: - '@xmldom/xmldom': 0.9.10 + '@xmldom/xmldom': 0.9.12 argparse: 1.0.10 base64-js: 1.5.1 bluebird: 3.4.7 @@ -14149,8 +14148,9 @@ snapshots: pure-rand@7.0.1: {} - qs@6.15.2: + qs@6.16.0: dependencies: + es-define-property: 1.0.1 side-channel: 1.1.1 queue-microtask@1.2.3: {} @@ -15155,7 +15155,7 @@ snapshots: dependencies: des.js: 1.1.0 js-md4: 0.3.2 - qs: 6.15.2 + qs: 6.16.0 tunnel: 0.0.6 underscore: 1.13.8 @@ -15203,7 +15203,7 @@ snapshots: union@0.5.0: dependencies: - qs: 6.15.2 + qs: 6.16.0 unique-string@2.0.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a773878e9..625865b05 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -16,6 +16,7 @@ blockExoticSubdeps: true minimumReleaseAge: 10080 minimumReleaseAgeExclude: - nanoid@3.3.18 + - qs@6.16.0 # QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+) # Overrides with security justifications: @@ -24,12 +25,12 @@ minimumReleaseAgeExclude: # - serialize-javascript: CVE-2024-XXXX - prototype pollution fix # - chrome-launcher: CVE-2024-XXXX - command injection fix # - tmp: GHSA-7c78-jf6q-g5cm - type-confusion _assertPath bypass (fixed 0.2.7) -# - @xmldom/xmldom: CVE-2024-XXXX - XSS fix +# - @xmldom/xmldom: GHSA-6gmq-8vp8-gcm6 - XML fragment injection via invalid EntityReference.nodeName (fixed 0.9.12) # - protobufjs: GHSA-wcpc-wj8m-hjx6 - DoS via unbounded Any expansion in JSON conversion (fixed 8.4.1); # raised to >=8.6.6 for GHSA-j3f2-48v5-ccww / GHSA-jfj6-75fj-8934 (2026-07) # - axios: CVE-2024-XXXX - SSRF fix # - basic-ftp: CVE-2024-XXXX - path traversal fix -# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5) +# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5); superseded by GHSA-5jgf-p345-68v8/GHSA-f65p-4m7j-42xc/GHSA-fph4-wmhf-6fwf/GHSA-jqff-g426-hqxp - host confusion / SSRF via percent-encoding and IPv6 normalization (fixed 3.1.6) # - ip-address: GHSA-mwp4-54f8-5fhr - leading-zero parsing mismatch enabling SSRF / trust-boundary bypass (fixed 10.3.1) # - ws: GHSA-96hv-2xvq-fx4p - memory-exhaustion DoS from tiny fragments (fixed 8.21.0) # - form-data: CRLF injection via unescaped boundary (fixed 4.0.6) @@ -37,7 +38,7 @@ minimumReleaseAgeExclude: # - uuid: GHSA-w5hq-g745-h8pq / CVE-2026-41907 - missing buffer bounds check in v3/v5/v6 API methods, # allows silent partial writes with an insufficient output buffer or wrong offset (fixed 11.1.1 / # 12.0.1 / 13.0.1 per major line; lockfile converges on 14.0.1, which the override floor now pins) -# - qs: GHSA-q8mj-m7cp-5q26 / CVE-2026-8723 - prototype pollution fix +# - qs: GHSA-hrpp-h998-j3pp / CVE-2022-24999 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed) # - esbuild: GHSA-67mh-4wv8-2f99 - dev-server CORS allowed any origin to read responses; # GHSA-gv7w-rqvm-qjhr - missing binary integrity verification (Deno module); # GHSA-g7r4-m6w7-qqqr - Windows path traversal in the dev-server file handler (all fixed 0.28.1) @@ -69,18 +70,18 @@ overrides: serialize-javascript: ">=7.0.3" chrome-launcher: "^1.2.1" tmp: ">=0.2.7" - "@xmldom/xmldom": ">=0.8.13" + "@xmldom/xmldom": ">=0.9.12" protobufjs: ">=8.6.6" axios: ">=1.18.0" basic-ftp: ">=5.3.1" - fast-uri: ">=3.1.5 <4" + fast-uri: ">=3.1.6 <4" ip-address: "10.3.1" ws: ">=8.21.0" form-data: ">=4.0.6" brace-expansion: ">=5.0.9" # QNBS-v3: excludes the two exact unpatched releases (12.0.0, 13.0.0) a bare ">=11.1.1" floor would still permit; the resolved 14.0.1 already satisfies this. uuid: ">=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1" - qs: ">=6.15.2" + qs: ">=6.16.0" dompurify: ">=3.4.13" "@babel/core": ">=7.29.6 <8" undici: ">=7.29.0 <8"