Skip to content

fix(frontend/deps): resolve fast-uri and svgo high-severity advisories - #1486

Merged
cristim merged 1 commit into
mainfrom
fix/npm-audit-fast-uri-svgo
Jul 22, 2026
Merged

cristim merged 1 commit into
mainfrom
fix/npm-audit-fast-uri-svgo

Conversation

@cristim

@cristim cristim commented Jul 22, 2026

Copy link
Copy Markdown
Member

Summary

Clears the two newly-published high-severity npm advisories that are currently failing Security Scanning on main HEAD, which blocks every open PR in the repo.

Advisory Package Affected Fixed Path (transitive)
GHSA-v2hh-gcrm-f6hx fast-uri 3.0.0-3.1.3 3.1.4 via ajv (ajv-formats / schema-utils, webpack tooling)
GHSA-2p49-hgcm-8545 svgo 4.0.0-4.0.1 4.0.2 via postcss-svgo (css-minimizer-webpack-plugin / cssnano)

Fix method

Both are transitive dev-dependencies. The fixed patch versions already satisfy the existing semver ranges (^3.0.1, ^4.0.1), so npm audit fix bumps only package-lock.json (6 lines). No package.json change or overrides block was needed, no downgrades, no breaking major bumps.

npm audit now reports 0 vulnerabilities.

Verification

  • npm audit: 0 vulnerabilities (both target advisories gone)
  • npm ci: exit 0
  • npm run build (webpack): success
  • npm test (jest): 2714 passed, 1 skipped
  • tsc --noEmit: clean
  • eslint: 0 errors

Impact

This unblocks Security Scanning across main and all currently-open PRs, so it is high-priority to merge.

Two newly-published high-severity npm advisories were failing Security
Scanning on main HEAD (and therefore blocking every open PR):

- fast-uri GHSA-v2hh-gcrm-f6hx (host confusion via literal backslash
  authority delimiter; affected 3.0.0-3.1.3), pulled in transitively via
  ajv (ajv-formats and schema-utils dependency chains, webpack tooling).
- svgo GHSA-2p49-hgcm-8545 (removeScripts plugin leaves some executable
  scripts intact; affected 4.0.0-4.0.1), pulled in transitively via
  postcss-svgo (css-minimizer-webpack-plugin / cssnano chain).

Both fixed versions (fast-uri 3.1.4, svgo 4.0.2) already satisfy the
existing semver ranges (^3.0.1, ^4.0.1), so `npm audit fix` bumps only
the lockfile. No package.json change or overrides block needed, and no
downgrades introduced. `npm audit` now reports 0 vulnerabilities.

Verified: npm ci, webpack build, jest (2714 pass), tsc --noEmit, and
eslint (0 errors) all succeed.
@cristim cristim added triaged Item has been triaged priority/p1 Next up; this sprint severity/high Significant harm urgency/now Drop other things impact/internal Team-internal only effort/xs Trivial / one-liner type/security Security finding labels Jul 22, 2026
@cristim

cristim commented Jul 22, 2026

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 22, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • frontend/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 01b1b6e5-dee5-4971-992e-818ff1ced8cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/npm-audit-fast-uri-svgo

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Jul 22, 2026 •

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@cristim
cristim merged commit 1cc33d3 into main Jul 22, 2026
20 checks passed
@cristim
cristim deleted the fix/npm-audit-fast-uri-svgo branch July 27, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

effort/xs Trivial / one-liner impact/internal Team-internal only priority/p1 Next up; this sprint severity/high Significant harm triaged Item has been triaged type/security Security finding urgency/now Drop other things

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant