resolve open security advisories - #1953
Merged
Merged
Conversation
Codegen v7 changed two things about its output: unmapped scalars default to `unknown` instead of `any`, and nullable fields on operation types are now required-but-nullable instead of optional. The scalar default is configurable, so codegen.ts pins it back to `any`. The optionality change isn't (in v6 `avoidOptionals` only covers input and variable values), so the remaining call sites are fixed directly. Two of those turned out to be a real bug: the linked identities card and the splits component both hand-copy ORCID fields and never selected `owner`, but orcid-tooltip renders it, so that row silently never showed up on either path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears 124 of the 125 open dependabot alerts (none of which actually exposed any critical vulns). Mostly bumps and overrides, but two things needed real code changes.
jimp 0.22 → 1.6 — v1 renamed most of the API (named exports,
cover({w,h}),getBuffer(JimpMime.x),image.mime), so the five image routes needed updating. Worth doing rather than dismissing, since thefile-typeinfinite-loop bug is reachable from/api/custom-avatars/upload, which takes user-supplied bytes.dropped
@pinata/sdkfor a small$lib/utils/pinata.ts. The SDK is a webpack bundle with axios 0.21 inlined into its dist — it never requires the external copy, so an npm override does nothing and the vulnerable code genuinely ships. We only used two calls and both are plain REST. Request shape is identical to what the SDK sent.Also removed the chromium pin in
Dockerfile.devwhile I was in there. 147 has been dropped from the debian repos entirely, so that line couldn't install at all anymore and any fresh dev/e2e image build would've failed on it. The 150 crash it guarded against is gone too — bookworm is on 150.0.7871.100 now, security on 151.The rest is bumps: lodash, puppeteer 23→25, otel 0.208→0.221, faro 1.18→2.9, graphql-codegen 5→7, svelte-fast-marquee, plus overrides for adm-zip/crypto-es/esbuild/joi/undici and a
@web3-onboard/core > svelteoverride that drops the nested EOL svelte 3 that was carrying 6 alerts on its own.Verified: svelte-check is identical to main's baseline, unit tests pass, full build + telemetry build pass, and 58 blog images prerender at the right dimensions through the new jimp path. web3-onboard's client chunk keeps the same content-hash filename, so the svelte override provably changed nothing in the output. Also smoke-tested the new pinata client against a stubbed fetch, and puppeteer 25 against real chromium 151 on both arm64 and amd64.
One alert stays open: elliptic (GHSA-848j-6mx2-7j84, low). No patched version exists at any release, and every path into it is hardhat via eas-contracts or the rsksmart e2e mock — neither ends up in the build. Planning to dismiss that one as not-in-execution-path.
Worth a staging pass on the metadata write flows and avatar upload, since those are what hit the new pinata code.