From 505fe93d2c81f54ef2a9a60c417db6597b7e1a41 Mon Sep 17 00:00:00 2001 From: Jyong Date: Tue, 4 Aug 2026 00:17:57 -0400 Subject: [PATCH] fix(knowledge-fs): update vulnerable transitive dependencies --- ...04-backend-dependency-security-upgrades.md | 34 +++++++++++++++++++ knowledge-fs/package.json | 3 +- knowledge-fs/pnpm-lock.yaml | 19 ++++++----- .../scripts/github-actions-workflow.test.mjs | 9 +++-- 4 files changed, 52 insertions(+), 13 deletions(-) create mode 100644 knowledge-fs/.harness/changes/2026-08-04-backend-dependency-security-upgrades.md diff --git a/knowledge-fs/.harness/changes/2026-08-04-backend-dependency-security-upgrades.md b/knowledge-fs/.harness/changes/2026-08-04-backend-dependency-security-upgrades.md new file mode 100644 index 00000000000..4cc35369c0a --- /dev/null +++ b/knowledge-fs/.harness/changes/2026-08-04-backend-dependency-security-upgrades.md @@ -0,0 +1,34 @@ +# Backend dependency security upgrades + +## What changed + +- Raised the workspace override for `fast-uri` from `3.1.4` to `3.1.5`. +- Added a workspace override for `ip-address` at `10.3.1`. +- Regenerated `pnpm-lock.yaml` so the `@modelcontextprotocol/sdk` dependency paths resolve the patched releases. +- Extended the CI workflow regression test to keep both security overrides and lockfile resolutions pinned. + +## Why + +The production dependency audit began blocking on two high-severity advisories published against the previously locked transitive versions: + +- `GHSA-7p8r-x3mc-p8w7` affected `fast-uri` versions before `3.1.5` in the selected major line. +- `GHSA-mwp4-54f8-5fhr` affected `ip-address` versions through `10.3.0`. + +Both patched versions remain within the dependency ranges declared by `ajv` and `express-rate-limit`, so the remediation does not require an MCP SDK or dependency-major upgrade. + +## Verification + +- Reproduced the failure with `pnpm security:dependencies`; both advisories were reported before the lock update. +- `pnpm install --frozen-lockfile`: passed. +- `pnpm security:dependencies`: passed with no high or critical backend production vulnerabilities. +- `node --test scripts/github-actions-workflow.test.mjs`: passed, 16 tests. +- `CI=1 pnpm check`: passed. +- `CI=1 pnpm build`: passed. +- `CI=1 pnpm lint:backend`: passed. +- `pnpm exec biome check package.json scripts/github-actions-workflow.test.mjs`: passed. +- `CI=1 pnpm lint`: remains blocked by 10 pre-existing repository-wide Admin formatting and oversized generated OpenAPI findings outside this dependency-only change. + +## Risks and follow-up + +- The overrides intentionally pin transitive dependencies until their direct parents advance their minimum versions. Dependabot and the security audit should continue to monitor them. +- No application behavior or API contract changed. diff --git a/knowledge-fs/package.json b/knowledge-fs/package.json index b00bac75733..2f2e63f046f 100644 --- a/knowledge-fs/package.json +++ b/knowledge-fs/package.json @@ -4,7 +4,8 @@ "packageManager": "pnpm@10.33.0", "pnpm": { "overrides": { - "fast-uri": "3.1.4", + "fast-uri": "3.1.5", + "ip-address": "10.3.1", "sharp": "0.35.3" } }, diff --git a/knowledge-fs/pnpm-lock.yaml b/knowledge-fs/pnpm-lock.yaml index f482b231786..1bf4a245b95 100644 --- a/knowledge-fs/pnpm-lock.yaml +++ b/knowledge-fs/pnpm-lock.yaml @@ -5,7 +5,8 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri: 3.1.4 + fast-uri: 3.1.5 + ip-address: 10.3.1 sharp: 0.35.3 importers: @@ -1647,8 +1648,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-xml-builder@1.2.0: resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==} @@ -1735,8 +1736,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.3.1: + resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2991,7 +2992,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3249,7 +3250,7 @@ snapshots: express-rate-limit@8.5.1(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.2.0 + ip-address: 10.3.1 express@5.2.1: dependencies: @@ -3286,7 +3287,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-xml-builder@1.2.0: dependencies: @@ -3392,7 +3393,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.2.0: {} + ip-address@10.3.1: {} ipaddr.js@1.9.1: {} diff --git a/knowledge-fs/scripts/github-actions-workflow.test.mjs b/knowledge-fs/scripts/github-actions-workflow.test.mjs index 511005d2553..ab11716aabd 100644 --- a/knowledge-fs/scripts/github-actions-workflow.test.mjs +++ b/knowledge-fs/scripts/github-actions-workflow.test.mjs @@ -144,10 +144,13 @@ test("root workflow runs explicit local security gates", () => { test("production dependency security fixes stay locked", () => { assert.equal(apiPackageJson.dependencies.sharp, "^0.35.3"); - assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.4"); + assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.5"); + assert.equal(packageJson.pnpm.overrides["ip-address"], "10.3.1"); assert.equal(packageJson.pnpm.overrides.sharp, "0.35.3"); - assert.match(lockfile, /^ {2}fast-uri@3\.1\.4:$/m); - assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.2:$/m); + assert.match(lockfile, /^ {2}fast-uri@3\.1\.5:$/m); + assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.4:$/m); + assert.match(lockfile, /^ {2}ip-address@10\.3\.1:$/m); + assert.doesNotMatch(lockfile, /^ {2}ip-address@10\.2\.0:$/m); assert.match(lockfile, /^ {2}sharp@0\.35\.3:$/m); assert.doesNotMatch(lockfile, /^ {2}sharp@0\.34\.5:$/m); });