Skip to content

CMT-2285: add security audit report and update package dependencies #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EvgeniiStepanishin wants to merge 1 commit into
base: main
Choose a base branch
from
+395 −217
Open

CMT-2285: add security audit report and update package dependencies #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 73 additions & 0 deletions SECURITY_AUDIT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# Security Audit: plugins-client-sdk

Repository: `@staffbase/plugins-client-sdk` (v3.0.0-alpha.4)
Package manager: Yarn Classic 1.22.19 (`yarn audit`; repo has no pnpm lockfile)
Date: 2026-06-10

## Summary

| Severity | Before | After |
|----------|--------|-------|
| Critical | 0 | 0 |
| High | 4 | 0 |
| Moderate | 36 | 0 |
| Low | 14 | 0 |
| **Total**| **54** | **0** |

12 unique advisories, all in **devDependencies** (build, test and docs tooling), all transitive.
Runtime dependencies (`loglevel`, `object.entries-ponyfill`) had no advisories.
The published package ships only `dist/` (pre-built), so none of these reach SDK consumers.
All issues were resolved by pinning patched versions via Yarn `resolutions`.

## Resolution

Added to the `resolutions` block in `package.json`:

```json
"@babel/plugin-transform-modules-systemjs": "^7.29.4",
"serialize-javascript": "^7.0.5",
"underscore": "^1.13.8",
"eslint/ajv": "^6.14.0",
"@eslint/eslintrc/ajv": "^6.14.0",
"brace-expansion": "^2.0.3",
"js-yaml": "^4.1.1",
"markdown-it": "^14.1.1",
"ws": "^8.20.1",
"esbuild": "^0.25.0",
"@tootallnate/once": "^2.0.1"
```

## Per-advisory decisions (all = RESOLVED)

| Pkg | Sev | Advisory | Path | Patched | Decision |
|-----|-----|----------|------|---------|----------|
| @babel/plugin-transform-modules-systemjs | High | GHSA-fv7c-fp4j-7gwp (CVE-2026-44728) arbitrary code on malicious input | @babel/preset-env | 7.29.4 | Resolved (resolution) |
| serialize-javascript | High | GHSA-5c6j-r48x-rmvq RCE via RegExp.flags | @rollup/plugin-terser | 7.0.5 | Resolved (resolution) |
| serialize-javascript | Mod | GHSA-qj8w-gfj5-8c6v (CVE-2026-34043) CPU exhaustion DoS | @rollup/plugin-terser | 7.0.5 | Resolved (same bump) |
| underscore | High | GHSA-qpx9-hpmf-5gmw (CVE-2026-27601) unbounded recursion DoS | jsdoc | 1.13.8 | Resolved (resolution) |
| ajv | Mod | GHSA-2g4f-4pwh-qvx6 (CVE-2025-69873) ReDoS via `$data` | eslint | 6.14.0 | Resolved (scoped resolution on eslint/eslintrc only; commitlint keeps ajv v8 to avoid the addKeyword API break) |
| brace-expansion | Mod | GHSA-f886-m6hf-6m8v (CVE-2026-33750) zero-step sequence hang | minimatch/glob | 2.0.3 | Resolved (resolution) |
| brace-expansion | Low | GHSA-v6h2-p8h4-qcjw (CVE-2025-5889) ReDoS | minimatch/glob | 2.0.3 | Resolved (same bump) |
| js-yaml | Mod | GHSA-mh29-5h37-fv8m (CVE-2025-64718) prototype pollution in merge | eslint, commitlint | 4.1.1 | Resolved (resolution) |
| markdown-it | Mod | GHSA-38c4-r59v-3vqw (CVE-2026-2327) ReDoS | jsdoc | 14.1.1 | Resolved (resolution) |
| ws | Mod | GHSA-58qx-3vcg-4xpx (CVE-2026-45736) uninitialized memory disclosure | jest-environment-jsdom/jsdom | 8.20.1 | Resolved (resolution) |
| esbuild | Mod | GHSA-67mh-4wv8-2f99 dev server SSRF/CORS | @size-limit/esbuild | 0.25.0 | Resolved (resolution); size-limit verified working |
| @tootallnate/once | Low | GHSA-vpq2-c234-7xj6 (CVE-2026-3449) incorrect control flow | jsdom/http-proxy-agent | 2.0.1 | Resolved (2.0.0 -> 2.0.1 patch) |

## Verification

After applying resolutions and reinstalling:

- `yarn audit` -> 0 vulnerabilities (all severities)
- `yarn lint` (eslint + size-limit) -> pass; bundle 6.88 kB / 8 kB limit
- `yarn test-unit` -> 52 passed, 6 suites
- `yarn build` -> all 4 dist bundles produced

Changed files: `package.json`, `yarn.lock`.

## Notes

- The esbuild bump (0.24 -> 0.25) is a minor-version major-ish jump for that tool; confirmed
safe because `size-limit` (its only consumer here) runs cleanly.
- All findings were dev-only and never bundled into `dist/`, so consumer-facing risk was already
nil; the resolutions keep the dev/CI toolchain clean going forward.
13 changes: 12 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,18 @@
"lodash": "^4.18.0",
"minimatch": "^5.1.8",
"wrap-ansi": "^7.0.0",
"semver": "^7.3.2"
"semver": "^7.3.2",
"@babel/plugin-transform-modules-systemjs": "^7.29.4",
"serialize-javascript": "^7.0.5",
"underscore": "^1.13.8",
"eslint/ajv": "^6.14.0",
"@eslint/eslintrc/ajv": "^6.14.0",
"brace-expansion": "^2.0.3",
"js-yaml": "^4.1.1",
"markdown-it": "^14.1.1",
"ws": "^8.20.1",
"esbuild": "^0.25.0",
"@tootallnate/once": "^2.0.1"
},
"packageManager": "yarn@1.22.19+sha1.4ba7fc5c6e704fce2066ecbfb0b0d8976fe62447"
}
Loading
Loading