[dev] [Marfuen] mariano/fix-dependabot-engineio-bodyparser#3465
Closed
github-actions[bot] wants to merge 2 commits into
Closed
[dev] [Marfuen] mariano/fix-dependabot-engineio-bodyparser#3465github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
- engine.io: add bun override to ^6.6.7. The vulnerable 6.5.5 (Engine.IO polling connection-exhaustion DoS, <6.6.7) was pulled transitively via @trigger.dev/core -> socket.io@4.7.4. Override collapses it to 6.6.9 (the version top-level socket.io@4.8.3 already uses); bun.lock now has a single engine.io@6.6.9. Not a reachable DoS for us (we run no engine.io server; trigger.dev uses it client-side) but removes the alert. - body-parser: bump the transitive dep in apps/mcp-server (runtime, via express@5.2.1) 2.2.2 -> 2.3.0 (patched; DoS via invalid limit silently disabling size enforcement). Lockfile-only; express's ^2.2.1 range permits 2.3.0, so it stays transitive and survives SDK regeneration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…erts (#94-#104) A batch of node-tar advisories (Critical→Moderate: decompression DoS, path traversal, symlink/hardlink escape, PAX parsing) flagged every tar copy below 7.5.19. bun.lock had tar@6.2.1 (x5, via build tooling: node-gyp, cacache, @electron/rebuild, app-builder-lib, giget), tar@7.5.11 (fleetctl), and tar@7.5.20 (already patched). node-tar backported no fixes to the 6.x line, so the only fix is tar >= 7.5.19. Added a bun override "tar": "^7.5.19" — bun.lock now resolves a single tar@7.5.20 for all consumers. tar@7 is a dual CJS/ESM package with a stable extract/create API, so the CJS build tools keep working via require(). Reachability was low pre-fix (all vulnerable copies were build-time tooling or trusted-source CLI extraction, none extract attacker-controlled archives in the runtime API), but the override removes the vulnerable versions entirely. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to merge mariano/fix-dependabot-engineio-bodyparser into dev.
It was created by the [Auto Pull Request] action.
Summary by cubic
Patch vulnerable transitive deps to clear Dependabot alerts with no app behavior changes: pin
engine.ioandtarto patched versions and bumpbody-parserin the MCP server.engine.io^6.6.7to force patched6.6.9(fixes Engine.IO polling DoS pulled via@trigger.dev/core→socket.io).tar^7.5.19to collapse all oldertarcopies to7.5.20(fixes multiple node-tar advisories).body-parserinapps/mcp-serverto2.3.0viaexpress@5(fixes request size limit handling).Written for commit ef80a47. Summary will update on new commits.