fix(deps): remediate dependency and image audit findings by 0xJem · Pull Request #77 · OlympusDAO/protocol-visualizer

0xJem · 2026-09-02T01:23:46Z

fix(deps): remediate dependency and image audit findings

Remediates the two high-severity browserslist advisories reported by pnpm audit and the container findings reported by Trivy.

Changes

Override vulnerable autoprefixer@<10.4.22 to 10.4.22.
Override vulnerable browserslist@<4.28.7 to mature patched ^4.28.8.
Regenerate pnpm-lock.yaml with pnpm 11.13.0.
Refresh the pinned gcr.io/distroless/nodejs24-debian13 index digest used by Dockerfile-indexer.
- The linux/amd64 and linux/arm64 children contain libssl3t64 3.5.7-1~deb13u2.
- This is the fixed version named by Trivy for the previous image's 3 medium and 1 high OpenSSL findings.
Extend the existing Hasura apt-get --only-upgrade allowlist with the eight installed Ubuntu packages named by Trivy: bsdutils, diffutils, libattr1, libblkid1, libmount1, libp11-kit0, libsmartcols1, and mount.
- This targets 24 medium findings with published Ubuntu fixes while retaining the base image and installed-package-only upgrade policy.
No .trivyignore entries or audit-policy exceptions were added.

Validation

pnpm install --frozen-lockfile: pass
pnpm audit --audit-level moderate: pass at the configured threshold; 2 low findings remain out of scope
pnpm run check:runtime-versions: pass
pnpm run lint:check: pass (6 packages)
pnpm run build: pass, including 15/15 config tests
Snapshot publisher: pass, including 21/21 tests and 7 generated sample snapshots (profile-local output used because /tmp quota was exhausted)
OCI registry verification: new digest resolves successfully; linux/amd64 and linux/arm64 package metadata record libssl3t64 3.5.7-1~deb13u2
git diff --check: clean

Docker is unavailable in the remediation environment. GitHub Actions therefore owns the authoritative image builds and Trivy scans for all six images.

Post-Deploy Monitoring & Validation

Watch the PR security-scan workflow and require all six Trivy image scans to complete successfully.
Search workflow logs for Total:, HIGH, CRITICAL, and the CVEs listed in failed scan output.
Healthy signal: pnpm audit succeeds and every image scan reports no unignored medium-or-higher fixed finding.
Failure signal: any Trivy step exits non-zero or later scans are skipped after an earlier failure.
Rollback trigger: image build/startup failure or a new medium-or-higher image finding introduced by these changes; revert the relevant container follow-up commit.
Validation window/owner: PR CI before merge; PR author/maintainer.

Published as a draft under the scheduled pnpm-audit-monitor authorization. No merge is included.

Summary by CodeRabbit

Chores
- Updated the application’s container runtime and system package baselines.
- Standardized supported frontend tooling versions for improved build consistency.
- No changes were made to application features, startup behavior, or public interfaces.

Override autoprefixer below 10.4.22 to 10.4.22 and browserslist below 4.28.7 to ^4.28.8 so the frontend resolves a single patched browserslist 4.28.8, clearing both high GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g advisories on the autoprefixer path.

coderabbitai · 2026-09-02T01:23:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: f62e7bd3-894c-4f6b-8c2d-d1092f709ca7

📥 Commits

Reviewing files that changed from the base of the PR and between 9cf2e31 and 92c7af0.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

Dockerfile-hasura
Dockerfile-indexer
pnpm-workspace.yaml

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The pull request updates Hasura system packages, refreshes the pinned indexer runtime image digest, and adds workspace overrides for autoprefixer and browserslist.

Changes

Hasura package updates

Layer / File(s)	Summary
Hasura apt package list `Dockerfile-hasura`	The apt upgrade list adds eight system packages: `bsdutils`, `diffutils`, `libattr1`, `libblkid1`, `libmount1`, `libp11-kit0`, `libsmartcols1`, and `mount`.

Indexer runtime image

Layer / File(s)	Summary
Pinned runtime image digest `Dockerfile-indexer`	The runtime stage uses an updated pinned `gcr.io/distroless/nodejs24-debian13` image digest.

Workspace dependency overrides

Layer / File(s)	Summary
Dependency version overrides `pnpm-workspace.yaml`	The workspace forces `autoprefixer` versions below `10.4.22` to `10.4.22` and `browserslist` versions below `4.28.7` to `^4.28.8`.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 92c7a

The PR updates vulnerable dependencies, container image inputs, and package upgrade allowlists to reduce reported security findings; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checks the packages bright
The runtime digest hops to right
Two dependencies join the queue
The workspace pins their versions true
Containers rest, refreshed and neat

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: remediation of dependency and container image audit findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/pnpm-security-20260902

_{Comment @coderabbitai help to get the list of available commands.}

railway-app · 2026-09-02T01:23:56Z

🚅 Deployed to the protocol-visualizer-pr-77 environment in protocol-visualizer

Service	Status	Updated
hasura	✅ Success (View Logs)	Sep 2, 2026 at 8:35 am UTC
frontend	⏭️ Skipped (View Logs)	Sep 2, 2026 at 8:30 am UTC
snapshot-gateway	⏭️ Skipped (View Logs)	Sep 2, 2026 at 8:30 am UTC
indexer	⏭️ Skipped (View Logs)	Sep 2, 2026 at 8:30 am UTC
snapshot-publisher	⏭️ Skipped (View Logs)	Sep 2, 2026 at 8:30 am UTC
snapshot-monitor	⏭️ Skipped (View Logs)	Sep 2, 2026 at 8:30 am UTC

socket-security · 2026-09-02T01:24:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	autoprefixer@10.4.20 ⏵ 10.4.22	⁺¹		^-1	⁺⁴

View full report

railway-app Bot temporarily deployed to protocol-visualizer / protocol-visualizer-pr-77 September 2, 2026 01:23 Destroyed

0xJem self-assigned this Sep 2, 2026

fix(container): update indexer OpenSSL runtime

2857379

railway-app Bot temporarily deployed to protocol-visualizer / protocol-visualizer-pr-77 September 2, 2026 08:19 Destroyed

0xJem changed the title ~~fix(deps): remediate browserslist audit findings~~ fix(deps): remediate dependency and image audit findings Sep 2, 2026

fix(container): patch Hasura runtime packages

92c7af0

railway-app Bot temporarily deployed to protocol-visualizer / protocol-visualizer-pr-77 September 2, 2026 08:30 Destroyed

0xJem marked this pull request as ready for review September 2, 2026 08:44

zeroxnoodle approved these changes Sep 2, 2026

View reviewed changes

0xJem merged commit c8290e9 into master Sep 3, 2026
18 checks passed

0xJem deleted the codex/pnpm-security-20260902 branch September 3, 2026 03:04

0xJem mentioned this pull request Sep 3, 2026

fix(deps): remediate post-merge audit findings #78

Merged

Navigation Menu

Uh oh!

fix(deps): remediate dependency and image audit findings - #77

fix(deps): remediate dependency and image audit findings#77
0xJem merged 3 commits into
masterfrom
codex/pnpm-security-20260902

0xJem commented Sep 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

railway-app Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

0xJem commented Sep 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

fix(deps): remediate dependency and image audit findings

Changes

Validation

Post-Deploy Monitoring & Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

railway-app Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

0xJem commented Sep 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

railway-app Bot commented Sep 2, 2026 •

edited

Loading

socket-security Bot commented Sep 2, 2026 •

edited

Loading