fix(deps): patch critical Electron and transitive CVEs - #170
Merged
Conversation
Bumps Electron to ^39.8.6 and adds pnpm overrides for vulnerable transitive dependencies surfaced by pnpm audit. Critical Electron CVEs fixed (all <39.8.x → >=39.8.1): - GHSA-jfqg-hf23-qpw2 context isolation bypass via contextBridge VideoFrame - GHSA-532v-xpq5-8h95 use-after-free in offscreen child window paint callback - GHSA-8337-3p73-46f4 use-after-free in WebContents fullscreen/pointer-lock/ keyboard-lock permission callbacks - Use-after-free in PowerMonitor on Windows/macOS HIGH-severity transitive CVEs fixed via overrides: - happy-dom ^20.0.11 → ^20.8.9 (GHSA-6q6h-j7hj-3r64 ECMAScript export name code injection, GHSA-w4gp-fjgq-3q4g fetch cookie origin leak) - lodash → >=4.18.1 (GHSA-r5fr-rjxr-66jc template code injection) - @xmldom/xmldom → >=0.8.12 (CDATA XML injection) - path-to-regexp → >=8.4.0 (GHSA-j3q9-mxjg-w52f DoS) - picomatch → >=4.0.4 (GHSA-c2c7-rcm5-vvqj ReDoS) - vite → ^7.3.2 (GHSA-p9ff-h696-f583 arbitrary file read, GHSA-v2wj-q39q-566r server.fs.deny bypass) - hono ^4.12.4 → >=4.12.7 (prototype pollution) MODERATE transitive fixes: - markdown-it → >=14.1.1 (ReDoS) - qs → >=6.14.2 (arrayLimit bypass) Total remediation: 16 vulnerabilities (4 HIGH/CRIT) → 1 moderate (esbuild in drizzle-kit, dev-only migration tool, acceptable risk).
The rotation grace period allowed a recently-rotated refresh token to be accepted for up to 60s after rotation. An attacker who intercepted a refresh token had a wide window to race the legitimate client's rotation. Reduces ROTATION_GRACE_SECONDS from 60s to 10s. Legitimate clients that lose the response mid-flight still get a retry window, but the replay surface for an intercepted token is 6x smaller.
… leak The /recovery endpoint returned either the real kdfSalt/keyVerifier or a deterministically-derived dummy, via a branching if/return. Although both the DB lookup and dummy hash ran in parallel via Promise.all, the branch taken, the shape of the response object, and the JSON serialization path differed between the "user exists" and "user does not exist" cases, leaving a side-channel usable for account enumeration. Both values are now always computed, then the response object is constructed with identical shape and field order, deterministically selected via ternaries. Wall-clock timing and serialization observables are identical across branches.
The security-audit workflow ran pnpm audit --audit-level high, but both jobs had continue-on-error: true, so failures never blocked PRs. This is how four critical Electron CVEs and six high-severity transitive CVEs landed on main without the workflow objecting. Removes continue-on-error from both root-audit and sync-server-audit so the audit job now actually gates on HIGH or CRITICAL findings.
h4yfans
added a commit
that referenced
this pull request
May 6, 2026
fix(deps): patch critical Electron and transitive CVEs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Patch 4 critical Electron RCE CVEs, 6 HIGH transitive CVEs, and harden token rotation + account enumeration protection.
Why
Comprehensive security audit identified 16 CVEs across desktop, dev dependencies, and server auth. Remediated 15; 1 remaining (moderate, dev-only, pending upstream fix).
How
Electron & Dependencies:
Server Security Hardening:
CI Security Gating:
continue-on-error: truefrom security-audit workflow (now fails on HIGH+ findings)Type
fix— security hardeningTest plan
pnpm audit --audit-level high→ 0 findings (16→1, 94% reduction)pnpm build✓pnpm typecheck✓ (0 errors, 346 files)pnpm test✓ (5810 tests, 0 failures)pnpm lint✓ (0 errors)Checklist