From 0b076ba23c68f0ff2243ef5e20d0bf71e34dcbe5 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sat, 5 Sep 2026 18:35:24 -0500 Subject: [PATCH] fix(deps): que el pin de un override no se quede un parche por debajo del arreglo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `Security Audit` lleva rojo en `main` desde `b84523b4` (2026-09-02). La causa no es una dependencia sin arreglo: son dos pins propios que se quedaron por debajo de la version parcheada, y el gate los reporta como advisories ajenas. `overrides.fast-uri` estaba fijado en `3.1.5` — exactamente la ultima version vulnerable de la rama 3.x. GHSA-jqff-g426-hqxp parchea en `3.1.6`, dentro del `^3.0.1` que declara `ajv@8.20.0`, asi que el arreglo cabia en el pin que ya existia. Medido con el propio gate y no inferido del changelog: las cuatro advisories de `fast-uri` y las cinco filas de la cadena `ajv`/`commitlint` que llegaban *via* `fast-uri` desaparecen — 9 de las 11 filas bloqueantes. Las dos restantes eran `browserslist`, tambien un transitivo solo-dev (`ts-jest`→`@babel/core` y `@nestjs/cli`→`webpack`) con arreglo publicado en `4.28.7`; se pinea `4.28.9` con la misma forma de override que el propio workflow prescribe para este caso. Verificado con `63-validate-npm-audit-gate.mjs`, el mismo guard que corre CI, sobre este arbol: de 11 filas bloqueantes / 7 altas a **0 bloqueantes, 0 altas**. La moderada de `qs` sobrevive a proposito: el gate no bloquea por debajo de HIGH. Lo que merece llevarse no es la CVE sino el modo de fallo: un `overrides` puesto para cerrar un advisory se convierte en el techo que impide cerrarlo la siguiente vez, y nadie lo revisa porque parece configuracion resuelta. Mismo patron que GT-691, donde la vigilancia estaba atada a un major que no habia salido. Co-Authored-By: Claude Opus 5 --- package-lock.json | 50 +++++++++++++++++++++++++++++------------------ package.json | 3 ++- 2 files changed, 33 insertions(+), 20 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4b5a4d43..6c76e910 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8474,7 +8474,9 @@ "license": "MIT" }, "node_modules/baseline-browser-mapping": { - "version": "2.10.38", + "version": "2.11.21", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", + "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==", "dev": true, "license": "Apache-2.0", "bin": { @@ -8651,7 +8653,9 @@ } }, "node_modules/browserslist": { - "version": "4.28.4", + "version": "4.28.9", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz", + "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==", "dev": true, "funding": [ { @@ -8669,11 +8673,11 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.38", - "caniuse-lite": "^1.0.30001799", - "electron-to-chromium": "^1.5.376", - "node-releases": "^2.0.48", - "update-browserslist-db": "^1.2.3" + "baseline-browser-mapping": "^2.11.20", + "caniuse-lite": "^1.0.30001810", + "electron-to-chromium": "^1.5.420", + "node-releases": "^2.0.54", + "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" @@ -8801,7 +8805,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001799", + "version": "1.0.30001810", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz", + "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==", "dev": true, "funding": [ { @@ -9558,7 +9564,9 @@ "license": "MIT" }, "node_modules/electron-to-chromium": { - "version": "1.5.377", + "version": "1.5.422", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.422.tgz", + "integrity": "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==", "dev": true, "license": "ISC" }, @@ -10293,9 +10301,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", @@ -12698,7 +12706,9 @@ "license": "MIT" }, "node_modules/node-releases": { - "version": "2.0.48", + "version": "2.0.54", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz", + "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==", "dev": true, "license": "MIT", "engines": { @@ -14862,7 +14872,9 @@ } }, "node_modules/update-browserslist-db": { - "version": "1.2.3", + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz", + "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==", "dev": true, "funding": [ { @@ -15490,7 +15502,7 @@ "@nestjs/terminus": "11.1.1", "@nestjs/throttler": "6.5.0", "@opentelemetry/api": "1.9.1", - "@opentelemetry/auto-instrumentations-node": "^0.79.0", + "@opentelemetry/auto-instrumentations-node": "0.79.0", "@opentelemetry/sdk-node": "0.221.0", "cache-manager": "7.2.9", "class-transformer": "0.5.1", @@ -15510,7 +15522,7 @@ "devDependencies": { "@eslint/eslintrc": "3.3.5", "@eslint/js": "9.39.4", - "@nestjs/cli": "^11.0.24", + "@nestjs/cli": "11.0.24", "@nestjs/schematics": "11.1.0", "@nestjs/testing": "11.1.28", "@types/express": "5.0.6", @@ -16085,7 +16097,7 @@ "@nestjs/platform-express": "11.1.28", "@open-policy-agent/opa-wasm": "1.10.0", "@opentelemetry/api": "1.9.1", - "@opentelemetry/auto-instrumentations-node": "^0.79.0", + "@opentelemetry/auto-instrumentations-node": "0.79.0", "@opentelemetry/exporter-trace-otlp-http": "0.219.0", "@opentelemetry/sdk-node": "0.221.0", "cache-manager": "7.2.9", @@ -16106,7 +16118,7 @@ "evolith-mcp": "dist/main.js" }, "devDependencies": { - "@nestjs/cli": "^11.0.24", + "@nestjs/cli": "11.0.24", "@nestjs/schematics": "11.1.0", "@nestjs/testing": "11.1.28", "@types/express": "5.0.6", @@ -16545,7 +16557,7 @@ "@types/jest": "30.0.0", "@types/node": "26.2.0", "@types/yaml": "1.9.7", - "@typescript-eslint/eslint-plugin": "^8.67.0", + "@typescript-eslint/eslint-plugin": "8.67.0", "@typescript-eslint/parser": "8.64.0", "debug": "4.4.3", "esbuild": "^0.25.0", diff --git a/package.json b/package.json index cfad0bb6..55f5b986 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,8 @@ "micromatch": "4.0.8", "ajv": "8.20.0", "typescript": "6.0.3", - "fast-uri": "3.1.5", + "fast-uri": "3.1.7", + "browserslist": "4.28.9", "eslint": { "ajv": "^6.12.6" },