fix(deps): patch security advisories for devalue, simple-git, postcss, nitropack#57
Conversation
… advisories Bump pnpm overrides to resolve 5 Dependabot alerts: - devalue >=5.8.1 (DoS via sparse array deserialization) - simple-git >=3.36.0 (RCE vulnerability) - postcss >=8.5.10 (XSS via unescaped style tags) - nitropack >=2.13.4 (path traversal and open redirect)
WalkthroughThis PR updates ChangesDependency Override Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 75: There is an unexpected change to the dependency constraint for "defu"
(the entry "defu": ">=6.1.5") — verify whether this override was intentional; if
it was accidental, revert this change from package.json and regenerate the
lockfile (package-lock.json or yarn.lock) so the commit no longer contains the
modified dependency, and if it was intentional, update the PR description to
explain why the version range was widened and add a brief note in the commit
message and changelog; also run the test suite and a dependency audit after
making the correction to ensure no regressions.
- Line 59: The devalue override currently set to ">= 5.8.1" is incorrect for the
stated security fixes; update the override in package.json for the dependency
entry "devalue" to ">= 5.6.4" so it includes the patched versions (5.6.3/5.6.4)
that address the sparse-array DoS and prototype pollution advisories—locate the
override line that currently contains "devalue": ">= 5.8.1" and change it to
"devalue": ">= 5.6.4".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c0b96b75-e19c-4000-ab84-6591541584d2
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
| "vite": "^6.4.2", | ||
| "qs": ">=6.14.2", | ||
| "simple-git": ">=3.32.3", | ||
| "simple-git": ">=3.36.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
simple-git 3.36.0 security advisory RCE vulnerability CVE
💡 Result:
simple-git 3.36.0 addresses an RCE vulnerability tracked as CVE-2026-6951. The issue affects versions of simple-git before 3.36.0 and is described as an incomplete fix for CVE-2022-25912: the protection blocks the -c option but not the equivalent --config form, allowing untrusted input to reach simple-git options and enable Git config protocol.ext.allow=always. With that enabled, an attacker can use an ext:: clone source to achieve remote code execution [1][2]. Evidence/details grounded in the sources: - NVD describes CVE-2026-6951 for “simple-git before 3.36.0” and explains the incomplete fix around blocking -c but not --config, with exploitation via protocol.ext.allow=always and ext:: clone [1]. - Snyk’s advisory for CVE-2026-6951 states the same root cause and recommends upgrading to simple-git 3.36.0 (or higher) [2]. Practical mitigation: - Upgrade simple-git to version 3.36.0 or later everywhere untrusted user input can influence the arguments/options passed to simple-git [2].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-6951
- 2: https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-15456078
🌐 Web query:
devalue 5.8.1 security advisory DoS sparse array CVE
💡 Result:
The devalue library has been subject to several security advisories related to Denial of Service (DoS) vulnerabilities, including issues involving sparse arrays and resource exhaustion. There is no single "5.8.1 security advisory" that encompasses all these issues; rather, multiple vulnerabilities were addressed in various versions leading up to and including 5.6.4 [1][2][3][4]. Key vulnerabilities identified in devalue include: 1. Sparse Array DoS (GHSA-33hq-fvwr-56pm): This vulnerability, affecting versions <= 5.6.2, involved CPU and memory amplification when serializing sparse arrays using uneval or stringify [1][5]. It was patched in version 5.6.3 [1][5]. This issue does not have an assigned CVE ID [1]. 2. Memory Exhaustion in devalue.parse (CVE-2026-22774): Affecting versions 5.3.0 through 5.6.1, this vulnerability allowed for asymmetric resource consumption due to improper ArrayBuffer type validation during hydration [2][6]. It was patched in version 5.6.2 [2][6]. 3. ArrayBuffer Hydration DoS (CVE-2026-22775): Affecting versions 5.1.0 through 5.6.1, this issue involved improper validation of base64 encoded strings during ArrayBuffer hydration, leading to potential DoS [3]. It was also patched in version 5.6.2 [3]. 4. Prototype Pollution (CVE-2026-30226): Affecting versions 5.6.3 and earlier, this vulnerability in devalue.parse and devalue.unflatten allowed for prototype pollution via maliciously crafted payloads, which could lead to DoS or type confusion [4]. This was patched in version 5.6.4 [4]. Users are advised to ensure they are using version 5.6.4 or later to mitigate these known vulnerabilities [7][4].
Citations:
- 1: GHSA-33hq-fvwr-56pm
- 2: GHSA-vw5p-8cq8-m7mv
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-22775
- 4: https://www.sentinelone.com/vulnerability-database/cve-2026-30226/
- 5: https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zM2hxLWZ2d3ItNTZwbc4ABSml
- 6: https://security.snyk.io/vuln/SNYK-JS-DEVALUE-14982188
- 7: https://www.npmjs.com/package/devalue
🌐 Web query:
postcss 8.5.10 security advisory XSS unescaped style tags CVE
💡 Result:
PostCSS versions prior to 8.5.10 are vulnerable to a Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-41305 [1][2]. The vulnerability exists because PostCSS does not properly escape </style> sequences when stringifying CSS Abstract Syntax Trees (ASTs) [3][1]. If an application parses user-submitted CSS and re-stringifies it for embedding directly within an HTML <style> tag, an attacker can inject a crafted CSS string containing </style> to break out of the style context and execute arbitrary JavaScript [3][4]. This issue was addressed in PostCSS version 8.5.10, which introduced the necessary escaping for </style> sequences [3][1]. Users are advised to upgrade to version 8.5.10 or higher to mitigate this risk [4][5]. The vulnerability has a CVSS v3 base score of 6.1 (Medium) [6][2].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-41305
- 2: https://www.tenable.com/cve/CVE-2026-41305
- 3: GHSA-qx2v-qp2m-jg93
- 4: https://security.snyk.io/vuln/SNYK-JS-POSTCSS-16189065
- 5: https://www.ibm.com/support/pages/security-bulletin-resolved-vulnerability-postcss-versions-prior-8510-1
- 6: https://zero.redgem.net/?p=49151
🌐 Web query:
nitropack 2.13.4 security advisory path traversal open redirect CVE
💡 Result:
The Nitro framework (often referred to as nitropack on npm) released version 2.13.4 to address two medium-severity security vulnerabilities related to route rule processing [1][2]. It is important to distinguish this framework from the NitroPack WordPress plugin, which is a separate product [3][4][5]. The vulnerabilities addressed in Nitro 2.13.4 are: 1. Open Redirect (CVE-2026-44372): This vulnerability allowed an attacker to bypass intended same-host rewrites in redirect route rules [6][7][8]. By crafting a URL with an extra slash (e.g., /legacy//evil.com), an attacker could force the application to respond with a protocol-relative URL (Location: //evil.com), causing the browser to redirect the user to an external, attacker-controlled site [7][8]. 2. Path Traversal (CVE-2026-44373): This vulnerability allowed an attacker to bypass proxy route rule scopes using percent-encoded path traversal sequences (e.g.,..%2f) [9][10]. This could cause the Nitro runtime to forward requests to upstream services that were intended to be protected or out-of-scope, potentially exposing internal endpoints or sensitive data [9]. These issues affect deployments where route rules are executed by the Nitro runtime [6][9]. Deployments that offload these rules to edge platforms (such as Vercel, Netlify, Cloudflare Pages, or EdgeOne) are generally not affected because the rules are handled natively at the CDN layer [6][8]. Users relying on proxy or redirect route rules are strongly encouraged to upgrade to version 2.13.4 or later [1][2].
Citations:
- 1: https://github.com/nitrojs/nitro/releases/tag/v2.13.4
- 2: https://newreleases.io/project/github/nitrojs/nitro/release/v2.13.4
- 3: https://app.opencve.io/cve/?product=nitropack&vendor=nitropack
- 4: https://patchstack.com/database/wordpress/plugin/nitropack
- 5: https://www.sentinelone.com/vulnerability-database/cve-2026-39669/
- 6: https://scout.docker.com/vulnerabilities/id/CVE-2026-44372?n=nitropack&s=github&t=npm&vr=%3C2.13.4
- 7: https://advisories.gitlab.com/npm/nitro/CVE-2026-44372/
- 8: https://www.resolvedsecurity.com/vulnerability-catalog/CVE-2026-44372
- 9: https://scout.docker.com/vulnerabilities/id/CVE-2026-44373?n=nitropack&s=github&t=npm&vr=%3C2.13.4
- 10: https://tuxcare.com/cve-tracker/cve/details/cve-2026-44373/
Correct devalue version override—specified version does not patch stated vulnerabilities.
The PR specifies devalue >= 5.8.1 to address DoS via sparse array deserialization, but security advisories confirm the patched versions are 5.6.3 (sparse array DoS, GHSA-33hq-fvwr-56pm) and 5.6.4 (prototype pollution, CVE-2026-30226). Version 5.8.1 does not appear in any devalue security advisory. Update to devalue >= 5.6.4.
The other three overrides are correctly specified:
simple-git >= 3.36.0patches CVE-2026-6951 (RCE) ✓postcss >= 8.5.10patches CVE-2026-41305 (XSS) ✓nitropack >= 2.13.4patches CVE-2026-44372 (open redirect) and CVE-2026-44373 (path traversal) ✓
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 59, The devalue override currently set to ">= 5.8.1" is
incorrect for the stated security fixes; update the override in package.json for
the dependency entry "devalue" to ">= 5.6.4" so it includes the patched versions
(5.6.3/5.6.4) that address the sparse-array DoS and prototype pollution
advisories—locate the override line that currently contains "devalue": ">=
5.8.1" and change it to "devalue": ">= 5.6.4".
| "minimatch@>=10.0.0 <11.0.0": "10.2.4", | ||
| "lodash": ">=4.18.0", | ||
| "defu": ">=6.1.5" | ||
| "defu": ">=6.1.5", |
There was a problem hiding this comment.
Verify the defu override is intentional.
The defu override at line 75 (>=6.1.5) is not mentioned in the PR objectives or summary. Confirm whether this change is intentional or if it was accidentally included.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 75, There is an unexpected change to the dependency
constraint for "defu" (the entry "defu": ">=6.1.5") — verify whether this
override was intentional; if it was accidental, revert this change from
package.json and regenerate the lockfile (package-lock.json or yarn.lock) so the
commit no longer contains the modified dependency, and if it was intentional,
update the PR description to explain why the version range was widened and add a
brief note in the commit message and changelog; also run the test suite and a
dependency audit after making the correction to ensure no regressions.
1 participant
Summary
devalueoverride to >=5.8.1 (high: DoS via sparse array deserialization)simple-gitoverride to >=3.36.0 (high: RCE vulnerability)postcssoverride >=8.5.10 (medium: XSS via unescaped style tags)nitropackoverride >=2.13.4 (medium: path traversal and open redirect)All are transitive deps of the Nuxt example app. No published package code changed.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit