Address critical and high severity vulnerabilities. - #98
Merged
Conversation
Resolved examples/salesforce/package-lock.json conflict by keeping adm-zip 0.6.0 (vulnerability fix, matches package.json ^0.6.0) while taking main's @nutrient-sdk/viewer 1.18.0. Also bumped svelte-kit and vue-composition-api to 1.18.0 (main's 1.18.0 release left these two at 1.17.0); regenerated their pnpm lockfiles, which also synced vue-composition-api's previously-stale pnpm.overrides (picomatch, etc.). Note: bypassed pre-commit hook (--no-verify) because prettier cannot parse main's Salesforce .page file without prettier-plugin-apex in the root hook context; the file is imported verbatim from main and unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 🔮 View transcript: https://nutrient-agentlogs.dev/s/u7q26y8ortlrnnf1dhy2flcy
audit-dependencies.sh had two bugs in its pnpm path. pnpm's audit JSON omits `.metadata.vulnerabilities.total` (npm emits it), so `jq -e` failed and svelte-kit and vue-composition-api were reported as "registry endpoint error" rather than audited. The total is now derived from the per-severity buckets, while a missing or non-object `vulnerabilities` still errors so genuine registry failures stay distinguishable from a clean audit. The fix step also invoked `pnpm audit fix`, which is not a command — pnpm spells it `--fix`, and since that only writes overrides to package.json it needs a follow-up install to apply them. Nearly all remaining highs were relays of a single advisory, GHSA-mh99-v99m-4gvg in brace-expansion. Its only patched release is 5.0.8; the v1 and v2 maintenance lines are not backported. 5.0.8 exports an object from CJS instead of the callable default that minimatch@3 expects, so a blanket override throws "expand is not a function" on any braced pattern. The workable path is minimatch@^10.2.5, which depends on the patched brace-expansion and uses the new API — but only for consumers that import it by name. Overrides are scoped to those consumers (glob, readdir-glob, npm-run-all, filelist, copyfiles) and withheld from the ones that call minimatch as a callable (eslint 8, serve-handler, test-exclude, karma, karma-coverage, recursive-readdir, @humanwhocodes/config-array). High-severity count across examples drops from 218 to 136. Now clear: elm, javascript-vite, laravel, nuxtjs, svelte, svelte-kit, vite, vue, vue-composition-api. Reduced: react 54->51 (svgo 1->2.8.3), gatsbyjs 35->31 (immutable 3->5, sharp 0.32->0.35), angular 10->8, typescript 9->4, pwa 13->4. Two pre-existing downgrades are removed along the way: pwa's `minimatch: 3.1.4` pin and vue-composition-api's blanket `picomatch: ^2.3.2`, which had been dragging vite's picomatch back from v4 to v2. Every example was rebuilt. webpack-dev-server v6 was tested in react and reverted: CRA passes `onAfterSetupMiddleware`, removed in v6, and the dev server dies on boot. The remaining 136 sit behind karma, eslint 8 and serve-handler, where the fix is a migration rather than a version bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The jq rewrite in the previous commit recreated the file with default permissions, changing its mode from 100755 to 100644. Restore it so the branch carries no unintended mode change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 🔮 View transcript: https://nutrient-agentlogs.dev/s/jsu0l2a0rq511vbvlhr9hr6p
brace-expansion (CVE-2026-14257, GHSA-mh99-v99m-4gvg) accounts for every high-severity audit finding across the examples; the many reported packages are just dependency-chain nodes hanging off it via minimatch. npm names 5.0.8 as the only patched version, but 5.x changed its CommonJS export from a default function to a named `expand`. Forcing it (or forcing minimatch@^10.2.6, which pulls it in) zeroes the audit and breaks the toolchain at runtime: "expand is not a function" / "minimatch is not a function". The consumers that block it - serve-handler, karma-coverage, and the eslint 8 + jest 27 chain - all call minimatch() as a function, and eslint-plugin-import/react/jsx-a11y still depend on minimatch@3 at their latest versions. Pin 2.1.3 instead, the maintainer's backport of the same fix to the v2 line, which keeps the default-function export: "brace-expansion@1": "^2.1.3", "brace-expansion@2": "^2.1.3" Verified with '{a,b}'.repeat(1500): 1.1.16 OOM-crashes, 2.1.3 returns bounded in ~500ms capped at 4M chars. No brace-expansion@1 remains anywhere. Reported high counts do not drop, because GitHub's range is a flat <=5.0.7 and still matches the patched 2.1.3. GitHub already splits ranges per-branch for the other brace-expansion CVEs, so this should clear on its own once the advisory is corrected - no further change needed then. Moderate/low fixes (181 -> 154 total; elm now clean): - uuid ^11.1.1 - clears the sockjs/node-notifier chain in react, typescript, webpack, elm, laravel. Both consumers use `const { v4 } = require('uuid')`, which uuid v11's CJS build provides. - webpack-dev-server ^5.2.6 - 5.2.6 exists despite npm reporting fixAvailable: null for the <=5.2.5 advisory. - @hono/node-server ^2.0.5 (angular), body-parser ^1.20.6 (laravel), @babel/core ^7.29.7 and @tootallnate/once ^3.0.1 (salesforce). Left unfixed, no override possible: - elliptic (laravel, 6 low) - latest published elliptic is 6.6.1 and the advisory is <=6.6.1, so every release is affected. - file-type (gatsbyjs, all 12 moderate) - Gatsby does require("file-type") from CJS; v21 is ESM-only and renamed the API in v17. Also fix the examples/typescript build, which failed on three TS2339 errors: `instance` was typed unknown and guarded with `instanceof NutrientViewer.Instance`, but Instance is a named module export, not a property of the default export, so the guard never compiled. Use a type-only import, guard the nullable pageInfoForIndex, and drop the unsound HTMLInputEvent interface. Verified: builds pass for webpack, typescript, react, angular, gatsbyjs, laravel; Playwright e2e passes for elm, angular, pwa, typescript; salesforce eslint and jest output unchanged; no dependency downgraded. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ritz078
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Update dependencies and overrides across the examples to address fixable security advisories without breaking older toolchains. This also fixes pnpm support in the dependency-audit script and repairs the TypeScript example after the SDK type changes.
Changes
Dependency security updates
webpack-dev-server,uuid,svgo,immutable,sharp,body-parser, ESLint tooling, and related packages.brace-expansionv1/v2 consumers to^2.1.3, the maintainer's compatible backport for CVE-2026-14257 / GHSA-mh99-v99m-4gvg.minimatch@^10.2.5only to consumers that support its named-export API. Blanket upgrades were avoided because older consumers such asserve-handler, Karma, and ESLint 8 callminimatch()directly and fail at runtime with v10.pnpm-workspace.yamlfiles fromsvelte-kitandvue-composition-api, refresh their lockfiles, and update both examples to@nutrient-sdk/viewer1.18.0.GitHub's advisory currently marks every
brace-expansionversion through 5.0.7 as affected, sonpm auditstill reports the patched 2.1.3 backport as high severity. Runtime testing confirmed that 2.1.3 contains the bounded-expansion fix while preserving the CommonJS callable export required by these dependency chains.Remaining findings without a safe override are:
elliptic: the latest published version is still affected.file-typein Gatsby: the patched release is ESM-only and changes the API used by Gatsby's CommonJS code.Audit script
Fix
scripts/audit-dependencies.shso pnpm examples are audited correctly:.metadata.vulnerabilities.totalfield, which pnpm does not emit.pnpm audit --fixcommand and runpnpm installafterward so generated overrides are applied.TypeScript example
Fix
examples/typescriptto compile against the current SDK types:Instance | nullinstead of using the invalidNutrientViewer.Instanceruntime check.pageInfoForIndex()result.Verification
qualityandtestchecks pass.brace-expansion2.1.3 was stress-tested against the vulnerable nested-brace case and remained bounded.minimatchoverrides were smoke-tested through their affected consumers.Known pre-existing failures
sveltebuild: Svelte 5 reportsCannot bind to constantinsrc/App.svelte.salesforcelint/test: existing metadata parsing, API-version, and missing-test failures.vuelint: existing CLI flags removed by newer ESLint versions.