fix(deps): override fflate to 0.8.3, fixing a ZIP64-parsing DoS - #595
Conversation
…-px8p-9vwx-vf98) fflate through 0.8.2 hangs in an infinite loop inside unzipSync() when parsing a crafted ZIP archive whose central directory declares the ZIP64 compressed_size sentinel (0xFFFFFFFF) but omits the required ZIP64 extra field -- z64e() reads out of bounds, the result coerces to 0, and the loop condition never becomes false. CVSS 7.5, CVE-2026-45820. Transitive via jspdf (already pinned to the latest 4.2.1, which already declares "fflate": "^0.8.1" -- a range 0.8.3 already satisfies, so no jspdf bump was needed, just forcing pnpm's resolution to the patched version already within range). The advisory was only elevated to GitHub-reviewed status today (2026-09-03T14:58:12Z, confirmed via the GitHub Advisories API) -- it is not something any recent change in this repo introduced; main's own Security Audit job passed clean two hours before this run first caught it.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedNext included review available in 1 minute. View limit detailsLimit details: You’ve used the included review currently available. Your 72 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Comment |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis security fix overrides pnpm's transitive fflate resolution to require >=0.8.3, ensuring jspdf uses the patched ZIP64 parser and preventing the unzipSync() infinite-loop DoS; the lockfile and workspace security documentation are updated accordingly. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
codeant-ai
Bot
added
the
size:XS
PR Summary
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Docker |  |
Sep 3, 2026 4:17p.m. | Review ↗ |
| Python | |
Sep 3, 2026 4:17p.m. | Review ↗ |
| Rust | |
Sep 3, 2026 4:17p.m. | Review ↗ |
| Shell | |
Sep 3, 2026 4:17p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR successfully migrates the project to a pnpm workspace structure. The changes to the lock file and workspace configuration are consistent with this migration, with no blocking issues identified.
The pnpm-lock.yaml has been properly regenerated with lockfileVersion 9.1, and all dependencies maintain their integrity hashes. The workspace configuration in pnpm-workspace.yaml correctly defines the package structure.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
2 issues found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="AUDIT.md">
<violation number="1" location="AUDIT.md:1855">
P3: Because the override accepts every version at or above `0.8.3`, saying “fixed 0.8.3” leaves the safe range ambiguous. Change this to “fixed at or above 0.8.3” to match the documented floor.</violation>
<violation number="2" location="AUDIT.md:1855">
P3: The table preamble now omits `fflate` from its re-verification-date exceptions even though this row records a 2026-09-03 advisory update. Add `fflate` and its 2026-09-03 verification date to that exception list, or update the table’s verification metadata so the audit record remains accurate.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
…e the fixed-version wording
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
* chore(release): bump version to v1.28.4 Patch release reconciling release-truth documentation with everything merged to main since v1.28.3 (62 commits / ~40 PRs, audited against live GitHub state, not assumed from commit subjects): - fix: PWA first-install unprompted reload (#585, PR #613) - fix: shared-origin service-worker cache-read isolation (#514, PR #612) - fix: Factory Reset could reboot into Settings instead of Welcome Portal (PR #592) - fix: preserve-first desktop corruption recovery (PR #542) and a distinct filesystem-I/O recovery action (PR #545) - fix: intentionally cleared project metadata no longer reappears (PR #546) - a11y: Welcome/Home dashboard WCAG AA contrast + reduced-motion cascade fix + default appearance preset change (#565, PR #609); ManuscriptEditor contrast (PR #560) - security: fflate ZIP64-parsing DoS override (PR #595); routine dependency floor bumps (PR #587, #561, #562, #594) - docs: R-15 secure desktop storage design contract admitted (PRs #564, #580, #581, #582, #584) — design only, no implementation yet - tests: visual regression testing repaired — baselines were directory listings, not the application (PR #610); IDB reset-quiescence hardening (PR #596); WelcomePortal E2E navigation made locale-independent (PR #590) Everything classified as pure internal/CI-governance churn (PR-size exception plumbing, dual-graph tooling, toolchain pins) is omitted from CHANGELOG.md as non-user-facing. Version bumped via the existing sync scripts (sync-tauri-version.mjs, sync-sw-version.mjs) across package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, src-tauri/Cargo.lock, AGENTS.md, and public/sw.js's APP_VERSION. CHANGELOG.md and README.md use the established release-candidate marker convention (<!-- release-candidate: v1.28.4 -->) so the dated entry and version badge are truthful before the v1.28.4 tag exists; both markers are removed in a follow-up post-release truth-sync once the tag and GitHub Release are published, matching the v1.28.2/v1.28.3 precedent. TODO.md's Current Sprint section was archived (its final "release cut remains open" bullet is now resolved — v1.28.2 and v1.28.3 both shipped) and replaced with the actual current sprint: this release cut followed by the R-15 desktop at-rest encryption priority program. AUDIT.md is intentionally not touched here — its release-gate entry requires real post-merge CI/CodeQL run evidence that doesn't exist until after this PR merges and the tag is cut, matching how every prior release's AUDIT.md entry was written (a follow-up commit, not part of the release-prep PR itself). * docs(release): correct premature done-marker on the v1.28.4 TODO item TODO.md's Current Sprint marked the release cut as done (checked 'v1.28.4' release cut, reconciling ... AUDIT.md truth ...) while this same PR's own Non-goals section correctly states AUDIT.md is not touched here, and while no tag, GitHub Release, or release artifacts exist yet. Corrected to in-progress language naming PR #615 directly and listing what actually remains pending (tag, release, artifacts, post-release AUDIT.md evidence). * docs(release): correct R-15 gate language and credit PR #596's real fix Two corrections from review, verified against live evidence before fixing: 1. TODO.md's Current Sprint claimed R-15 desktop at-rest encryption implementation was being prioritized now. docs/native/DESKTOP- MIGRATION-ROADMAP-REV3.md explicitly forbids pulling Wave 3/4 R-15 implementation ahead of unresolved Wave 2 authority prerequisites, and CORE-MIGRATION-LEDGER.md row 10 records S5_IMPLEMENTATION_READY=NO. Corrected to state R-15 design is complete but implementation stays gated behind the still-open Wave 2 prerequisite (ledger row 9: the project state-shape compatibility adapter), which is what this sprint's desktop-storage work actually is. 2. CHANGELOG.md listed PR #596 only as generic IDB test hardening under Tests. Verified against its actual diff: deleteDatabase() previously resolved on a genuine onerror or an onblocked event as if deletion succeeded, so wipeAllAppData() could report Factory Reset complete while a database was never actually deleted. onerror now rejects; onblocked waits for the connection to close before giving up. This is a real production data-integrity fix, not test hardening, and now has its own Fixed entry.
1 participant
Summary
fflatethrough 0.8.2 hangs in an infinite loop insideunzipSync()when parsing a crafted ZIP archive whose central directory declares the ZIP64compressed_sizesentinel (0xFFFFFFFF) but omits the required ZIP64 extra field —z64e()reads out of bounds, the result coerces to0, and the loop condition never becomes false. CVSS 6.6 (GitHub Reviewed, CVSS v4; the same advisory's older CVSS v3.1 vector scores 7.5 — GitHub's live "Moderate" severity classification uses the v4 score as canonical), GHSA-px8p-9vwx-vf98 / CVE-2026-45820.Transitive via
jspdf(already pinned to the latest4.2.1, which already declares"fflate": "^0.8.1"— a range0.8.3already satisfies, so nojspdfbump was needed, just forcing pnpm's resolution to the patched version already within range viapnpm.overrides).Not caused by any recent change here — the advisory was only elevated to GitHub-reviewed status today (
2026-09-03T14:58:12Z, confirmed via the GitHub Advisories API). Main's own Security Audit job passed clean two hours before this run first caught it; it started blocking every PR (including an unrelated governance-config PR, #586) the moment the advisory went live.Test plan
pnpm why fflate→ resolves to0.8.3pnpm audit --audit-level=high→ the fflate finding is gone; only the pre-existing, already-documentedextract-zipadvisory (no fix available, transitive Playwright browser download, no runtime footprint) remainspnpm run lint/pnpm run ci:prepush— cleanSummary by Sourcery
Pin the transitive fflate dependency to a patched version to prevent denial-of-service attacks from malformed ZIP64 archives.
Bug Fixes:
Enhancements:
Documentation:
Chores: