fix(security): eliminate extract-zip from the Lighthouse dependency graph - #682
Conversation
…raph Dependabot #86 flagged extract-zip@2.0.1 (GHSA-7pqw-9j4j-h8q3, high; GHSA-jmr9-qjv8-65gv, already-accepted), reachable only via @lhci/cli's hard-pinned lighthouse@12.6.1 -> puppeteer-core -> @puppeteer/browsers@2.x devDependency chain. No patched extract-zip release exists, but @puppeteer/browsers 3.x (pulled in by lighthouse 13.x's puppeteer-core ^25.x) replaced extract-zip with modern-tar entirely. @lhci/cli@0.15.1 is the latest published release and hard-pins lighthouse to an exact version, so no parent-package upgrade alone reaches the fix. A pnpm-workspace.yaml overrides.lighthouse: ">=13.4.1" entry forces the whole chain onto the modern, extract-zip-free stack. Verified @lhci/cli invokes lighthouse via CLI subprocess (stable --output json --output-path contract), not an internal API import, and lighthouse 13.4.1 keeps the identical package-layout convention as 12.6.1. pnpm why extract-zip now returns nothing; the package has zero occurrences in pnpm-lock.yaml. Functionally validated: lhci healthcheck passes, and a real lighthouse CLI audit against a live URL (Chrome launch, navigation, full performance audit, valid JSON output) succeeded end-to-end. Removes both now-obsolete extract-zip IgnoredVulns entries from src-tauri/osv-scanner.toml, and corrects two historical AUDIT.md entries that had misattributed the chain to Playwright instead of Lighthouse CI's own Puppeteer stack.
Reviewer's GuideEliminates extract-zip from the dependency graph by overriding @lhci/cli’s hard-pinned Lighthouse 12.x dependency to Lighthouse 13.4.1+, causing the Puppeteer browser stack to use modern-tar instead. The lockfile, OSV ignores, audit history, Dependabot triage, and changelog were updated, with CLI compatibility and end-to-end validation recorded. Sequence diagram for Lighthouse CLI compatibility validationsequenceDiagram
participant LHCI as @lhci/cli
participant Lighthouse as lighthouse@13.4.1
participant Chrome
LHCI->>Lighthouse: spawn --output json --output-path <path>
Lighthouse->>Chrome: launch and navigate
Chrome-->>Lighthouse: audit results
Lighthouse-->>LHCI: valid JSON output
LHCI-->>LHCI: lhci healthcheck --fatal
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
🤖 CodeAnt AI — Review Status
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
codeant-ai
Bot
added
the
size:L
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Warning Review limit reachedNext included review available in 10 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 81 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (9)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe change requires Lighthouse 13.4.1 or newer, removes Changesextract-zip remediation
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The dependency override removes the vulnerable extract-zip path and updates its related advisory records. No merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="pnpm-workspace.yaml" line_range="102" />
<code_context>
+ # hard-pins lighthouse@12.6.1, which pulls puppeteer-core -> @puppeteer/browsers@2.x ->
+ # extract-zip. lighthouse 13.x's puppeteer-core (^25.x) uses @puppeteer/browsers 3.x, which
+ # replaced extract-zip with modern-tar, eliminating the vulnerable package from the graph.
+ lighthouse: ">=13.4.1"
peerDependencyRules:
</code_context>
<issue_to_address>
**issue (bug_risk):** The override selects `lighthouse@13.4.1`, whose package requires Node `>=22.19`, while this repository still declares and supports Node `>=22.0.0` and `.nvmrc` contains only `22`; installs or `lhci` runs on Node 22.0–22.18 therefore violate the resolved package's engine contract.
**Triggers:** When a supported environment uses Node 22.0 through 22.18 rather than the latest Node 22 patch release.
**Suggested fix:** Raise the repository's Node floor and pinning documentation to `>=22.19.0`, or select a Lighthouse version compatible with the existing Node `>=22.0.0` support range.
</issue_to_address>Sourcery assessment
Approval pending. 1 finding to address first.
Blocking findings: pnpm-workspace.yaml:102
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c5715d097
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…d override Three review findings addressed together: - lighthouse@13.4.1 requires Node >=22.19, but package.json declared >=22.0.0 with engineStrict: true - a real contract mismatch. Raised engines.node to >=22.19.0 and reconciled CONTRIBUTING.md's Windows setup step and docs/DEPLOYMENT.md's Vercel prerequisite to match. .nvmrc stays "22" deliberately: actions/setup-node's node-version-file resolution always picks the latest available 22.x release, which mechanically satisfies >=22.19 without needing an exact pin there. - Tightened the lighthouse override from ">=13.4.1" to the exact "13.4.1" actually compatibility-tested in this PR - @lhci/cli@0.15.1 is untested against later Lighthouse majors, so an unbounded range could silently resolve to an incompatible 14.x/15.x during an unrelated future lockfile reconciliation. - Added a lighthouse row to AUDIT.md's Known Overrides Table, matching its existing schema, and updated the two prose mentions of the old ">=13.4.1" range to reflect the exact pin. Also carries forward the deferred Cubic P3 from #681: TODO.md's sprint status marker was still "in progress" despite every deliverable being done. Re-verified after the changes: lighthouse resolves to exactly 13.4.1, extract-zip remains fully absent, @puppeteer/browsers stays on 3.x, pnpm audit reports only the separate adm-zip finding, lhci healthcheck passes, and a real Lighthouse CLI audit against a live URL still succeeds end-to-end.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
[check-pr-size] PR size is over the target tier (normal profile): 11 files (12 total incl. generated), 92 meaningful lines, 3 commits — limit ≤8 files / ≤400 lines / ≤6 commits. Consider splitting into smaller, independently reviewable PRs. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e680c297a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex found four more current-state setup/troubleshooting references still advertising plain Node >=22 after the engine floor was raised: CONTRIBUTING.md's cross-platform prerequisites line, three README.md mentions (quick-start, deployment prerequisites, install comment), and infra/low-end-ci/INSTALL.md's fnm troubleshooting row (also switched to `fnm install 22 --latest` since a stale locally-installed 22.x would still fail engineStrict).
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
…) (#683) * docs(security): record exhaustive adm-zip investigation (Dependabot #87) No code/config change - this is a documentation-only evidence update. Dependabot #87 (GHSA-vwc7-r8mq-g2x9, adm-zip) was investigated for a real remediation path, exhaustively: - No patched adm-zip release exists (GitHub advisory API: first_patched_version: null). - No upgrade path removes it: @huggingface/transformers@4.2.0 (latest stable) hard-pins onnxruntime-node as an exact, mandatory dependency, and onnxruntime-node@1.29.0 (latest stable) still depends on adm-zip@^0.6.0. - Beyond the existing allowBuilds: onnxruntime-node=false mitigation (denies the postinstall script that is adm-zip's only caller), a second independent layer was confirmed: @huggingface/transformers's own package exports map routes every bundler/browser consumer (Vite, for both the PWA build and the Tauri WebView frontend) to dist/transformers.web.js, which contains zero real reference to onnxruntime-node - only a genuine Node.js require/import resolution hits the "node" export condition. This repo has no such code path, confirmed via source inspection and this repo's own test suite (which explicitly mocks the web build path). - A narrow onnxruntime-node>adm-zip pnpm override to a stub package was considered and rejected: it would add a fake-package maintenance burden for a vulnerability already proven unreachable through two independent, upstream-supported mechanisms. Terminal outcome: BLOCKED UPSTREAM / CURRENTLY MITIGATED, not retired. The existing OSV ignore stays; its comment is expanded with this evidence trail. Also fixes a stale ">=13.4.1" reference in docs/DEPENDABOT-TRIAGE.md left over from PR #682's later exact-pin correction. * docs(security): correct adm-zip mitigation claims and override wording Two real issues from review, addressed together: - Wrongly described adm-zip: ">=0.6.0" as pinning the newest release. It is a floor: it permits any future adm-zip version from 0.6.0 upward and only resolves to 0.6.0 today because that's still the newest published version. - Wrongly framed Vite's browser-build bundling as a second, independent install-time mitigation alongside allowBuilds: onnxruntime-node=false. The vulnerable operation is adm-zip running inside onnxruntime-node's own postinstall script during pnpm install's lifecycle-script phase - entirely before any bundler is involved. Vite cannot protect against that. allowBuilds is the sole install-time mitigation; the bundling fact is separate, independent evidence about a different question (whether the shipped app's own JS ever imports onnxruntime-node at runtime - it doesn't). Also corrects the mechanism cited for that separate fact: the repository's actual protection is a direct vite.config.ts resolve.alias hardcoding @huggingface/transformers to dist/transformers.web.js, which bypasses the package's own exports map entirely - not the exports map itself as previously described.
1 participant
User description
Purpose
Dependabot #86:
extract-zip@2.0.1(GHSA-7pqw-9j4j-h8q3, high) reachable only via@lhci/cli's hard-pinnedlighthouse@12.6.1→puppeteer-core→@puppeteer/browsers@2.xdevDependency chain (not this repo's separate Playwright devDependency). No patchedextract-ziprelease exists.Fix
@puppeteer/browsers3.x (pulled in bylighthouse13.x'spuppeteer-core^25.x) replacedextract-zipwithmodern-tarentirely.@lhci/cli@0.15.1is the latest published release and hard-pinslighthouseto an exact version, so apnpm-workspace.yamloverrides.lighthouse: ">=13.4.1"entry forces the whole chain onto the modern,extract-zip-free stack.Verification
@lhci/cliinvokes lighthouse via CLI subprocess (--output json --output-path <path>), not an internal API import — de-risking the major-version jump.lighthouse@13.4.1keeps the identical package-layout convention as 12.6.1.pnpm why extract-zipreturns nothing; zero occurrences inpnpm-lock.yaml.pnpm auditno longer reports the extract-zip advisories (1 moderate remains — the separate, independentadm-zipfinding, Dependabot feat: Native File Associations (.storycraft/.scst) and Single-Instance behavior #87, untouched here).lhci healthcheck --fatalpasses.lighthouse@13.4.1CLI audit against a live URL succeeded end-to-end (Chrome launch, navigation, full performance audit, valid JSON output).node scripts/check-doc-metrics.mjsandpnpm run ci:prepushboth pass locally.Docs
extract-zipIgnoredVulnsentries fromsrc-tauri/osv-scanner.toml.AUDIT.mdentries that misattributed the chain to Playwright instead of Lighthouse CI's own Puppeteer stack.docs/DEPENDABOT-TRIAGE.mdupdated to record the retirement.Summary by Sourcery
Eliminate the vulnerable Lighthouse transitive dependency while maintaining Lighthouse CI functionality and aligning project requirements with the upgraded toolchain.
Bug Fixes:
extract-zippackage and its two associated advisories from the Lighthouse CI dependency graph.Enhancements:
Documentation:
Tests:
Chores:
CodeAnt-AI Description
Remove the vulnerable
extract-zippackage from the Lighthouse CI dependency graphWhat Changed
extract-zipwithmodern-tarextract-zipor its two associated security advisoriesImpact
✅ No extract-zip package in installed dependencies✅ Security audit no longer flags two extract-zip advisories✅ Lighthouse audits continue to run successfully💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by cubic
Eliminates the vulnerable
extract-zippackage from the dependency graph by overridinglighthouseto exactly13.4.1(which dropsextract-zipin favor ofmodern-tar), and raises the Node floor to 22.19 to match the new Lighthouse requirement.extract-zip@2.0.1(GHSA-7pqw-9j4j-h8q3 and GHSA-jmr9-qjv8-65gv) had no patched release and was reachable only via@lhci/cli's hard-pinnedlighthouse@12.6.1devDependency chain.@lhci/cliis only compatibility-tested against 13.4.1.engines.nodeis now>=22.19.0, and every setup/troubleshooting doc (CONTRIBUTING.md,README.md,docs/DEPLOYMENT.md,infra/low-end-ci/INSTALL.md) advertises the new floor.pnpm why extract-zipreturns nothing,pnpm auditshows only the unrelatedadm-zipfinding, andlhci healthcheckplus a live Lighthouse audit pass.extract-zipignored-vuln entries fromsrc-tauri/osv-scanner.toml, corrected twoAUDIT.mdentries, and added alighthouserow to the Known Overrides Table.Written for commit 8e4c2de. Summary will update on new commits.
Summary by CodeRabbit
Bug Fixes
extract-zippackage from the resolved dependency graph by requiring Lighthouse 13.4.1 or later.Documentation