fix: pin liquidjs to 10.27.1 for memoryLimit DoS advisories - #480
Conversation
Add a pnpm override so ecto's ^10.27.0 range cannot resolve 10.27.0. This covers CVE-2026-55575 and AIKIDO-2026-127306 (pop/sample filters bypass memoryLimit accounting). Co-authored-by: Jared Wray <me@jaredwray.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #480 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 18 18
Lines 2760 2760
Branches 846 837 -9
=========================================
Hits 2760 2760 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa2876f25f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| overrides: | ||
| "undici@>=8.0.0 <8.9.0": "8.10.0" | ||
| "undici@>=7.0.0 <7.29.0": "7.29.0" | ||
| "liquidjs@<10.27.1": "10.27.1" |
There was a problem hiding this comment.
When a released Docula version is installed or updated in a project whose lockfile already contains ecto@5.0.0 with liquidjs@10.27.0, this root-only pnpm override is not inherited by the consumer's package manager. Since the published package.json still depends on ecto@^5.0.0 and ecto's ^10.27.0 range continues to accept the vulnerable release, the consumer may retain 10.27.0, meaning this security change protects this repository and bundled builds but not all package users; encode the raised transitive floor in published dependency metadata, such as through an ecto release that requires LiquidJS 10.27.1 or later.
Useful? React with 👍 / 👎.
2 participants
Please check if the PR fulfills these requirements
What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
Security dependency fix.
Why this change is needed
Aikido reported two
liquidjsadvisories inpnpm-lock.yaml:popfilter clones arrays without chargingmemoryLimitpop/samplefilters bypassmemoryLimitaccountingWorst-case impact is a denial-of-service via unbounded memory allocation. Both are fixed in
liquidjs10.27.1.liquidjsis a transitive dependency ofecto(^10.27.0), which had resolved to 10.27.0.What this PR does
Adds a pnpm override (same pattern as the existing
undicipins) so anyliquidjsbelow 10.27.1 is forced to 10.27.1, and updates the lockfile accordingly.No application source changes. Existing tests cover template rendering through
ecto.Verification
pnpm why liquidjsreports a single copy:liquidjs@10.27.1viaecto@5.0.0pnpm test: 17 files / 866 tests passed, 100% statement/branch/function/line coverage