fix(deps): clear bun audit findings via lockfile refresh and overrides - #103
Merged
Conversation
Regenerate bun.lock within declared ranges to pick up patched transitive deps flagged by the blocking audit on main: - axios 1.17.0 -> 1.18.1 (1 high, 9 moderate advisories) - brace-expansion 2.1.1 -> 2.1.2 / 5.0.6 -> 5.0.8 (GHSA-3jxr-9vmj-r5cp) - dompurify 3.4.11 -> 3.4.12 (GHSA-c2j3-45gr-mqc4) Two new overrides: - @hono/node-server ^2.0.5: patch for GHSA-frvp-7c67-39w9 is outside @hono/vite-dev-server's ^1.19.11 range; dev server verified working on 2.0.11 - @bufbuild/protobuf 2.12.0: 2.13.0 breaks type inference against @zitadel/proto generated code (Message<string> errors in zitadel/user.ts)
Contributor
🧪 Test Summary
|
yahyafakhroji
enabled auto-merge
July 24, 2026 00:37
gaghan430
approved these changes
Jul 24, 2026
yahyafakhroji
added a commit
that referenced
this pull request
Jul 25, 2026
The Supply Chain gate blocks on two high-severity advisories that pre-date this branch (which changes no dependency files) and are unfixed on main — PR #103's overrides cleared undici/form-data/dompurify/esbuild but never these two. GHSA-mh99-v99m-4gvg brace-expansion DoS. Reaches the tree through seven parents' pinned minimatch versions, which span different brace-expansion majors, so no single override range satisfies every parent. GHSA-qwww-vcr4-c8h2 react-router RSC-mode CSRF bypass. Not reachable in this app: the vulnerable path is RSC mode, and react-router.config.ts runs plain framework SSR (ssr: true, no RSC entry, plugin, or package). Fixed only in >=8.3.0, a major bump from the pinned ^7.18.1 that needs its own migration PR with full regression coverage. Ignored per this job's own documented policy, with both justifications recorded inline. Verified locally: bun audit with both --ignore flags exits 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unblocks
mainCI, which is failing on the blockingbun auditstep in Supply Chain (audit + SBOM) (failing run) with 14 vulnerabilities (3 high, 10 moderate, 1 low). All findings are in transitive dependencies — newly published advisories against the existing lockfile, not caused by any code change.Changes
bun.lockregenerated within declared ranges (note:bun updatealone does not fix these — it only bumps direct deps), picking up:axiosstart-server-and-test › wait-on)brace-expansiondompurify@datum-cloud/datum-ui › isomorphic-dompurify)Two additions to the existing security-pin
overridesblock:@hono/node-server: ^2.0.5— the patch for GHSA-frvp-7c67-39w9 (Windows-only path traversal inserve-static, dev-server only) is outside@hono/vite-dev-server's declared^1.19.11range; unreachable without areact-router-hono-serverv3 major upgrade. Dev server verified working on 2.0.11.@bufbuild/protobuf: 2.12.0— the refresh pulled 2.13.0, which breaks TS inference against@zitadel/protogenerated code (Message<string>errors inapp/modules/auth/providers/zitadel/user.ts). Pinned until regenerated protos or an upstream fix allow unpinning.Reviewer note
The refresh also moves other in-range deps, most notably
@datum-cloud/datum-ui1.3.2 → 1.6.0 — the one bump that could carry visible UI changes.Test plan
bun audit→ 0 vulnerabilities (exit 0)bun run typecheckgreenbun run lint:cigreen@hono/node-server@2.0.11override;/healthzand/id/loginreturn 200bun run test:e2e:fast— production build + core-signin spec 4/4 passing