Repository navigation
fix(deps): patch remaining Dependabot and Trivy vulnerabilities - #99
Merged
Merged
Conversation
Bump direct dependencies: - moment ^2.31.0 (CVE-2026-17495) - dompurify ^3.4.16 (GHSA-p98j-92pf-mc4p) - brace-expansion ^5.0.12 Raise or add overrides for transitive dependencies: - handlebars ^4.7.10 (CVE-2026-106444/106445/106446) - undici ^6.28.1 (CVE-2026-19534, CVE-2026-85024) - compression ^1.8.2 (CVE-2026-87776) - fast-uri ^3.1.7, unpinned from vulnerable 3.1.6 (CVE-2026-84394) - source-map-js ^1.2.2 (CVE-2026-93749) - ip-address ^10.7.2 - npm ^11.21.1, whose bundled undici, ip-address, postcss-selector-parser and brace-expansion are patched. Overrides cannot reach bundled dependencies, so this bump is what fixes them. braces and sprintf-js have no patched release yet and stay open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mayuran-deriv
requested review from
matin-deriv and
nijil-deriv
as code owners
October 20, 2026 11:21
Contributor
Dependency ReviewThe following issues were found:
OpenSSF ScorecardScorecard details
Scanned Manifest Filespackage-lock.json
|
Contributor
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
Deploying trading-bot-template with
|
| Latest commit: |
649863c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c4b19498.trading-bot-template.pages.dev |
| Branch Preview URL: | https://fix-security-dependency-aler.trading-bot-template.pages.dev |
Neither package has a patched release, so remove them instead: - node-forge (high) came from @rsbuild/plugin-basic-ssl 1.x via selfsigned 3. Replace the plugin with a small local equivalent built on selfsigned 5, which drops node-forge. selfsigned 5's generate() is async, which is why the 1.x plugin can't simply be overridden. The dev server still gets a self-signed localhost certificate, reused for 30 days, now signed with SHA-256. It's cached under node_modules/.cache/basic-ssl. - sprintf-js (medium) came from argparse 1 via js-yaml 3, which @istanbuljs/load-nyc-config needs. js-yaml 3 only uses argparse in its CLI binary, so override argparse to 2.x (no dependencies) for that path. braces 3.0.3 (CVE-2026-93687) is still open. It's the latest release and upstream hasn't shipped a fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
maryia-deriv
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #98. Clears 24 of the 25 open Dependabot alerts, including the 11 Dependabot opened on 2026-10-20, and the blocking findings in the Trivy SCA scan.
Direct dependencies
moment^2.30.1 → ^2.31.0dompurify^3.4.13 → ^3.4.16brace-expansion^5.0.9 → ^5.0.12Overrides (transitive dependencies)
handlebars→ ^4.7.10 (new). Fixes 2 critical and 1 medium alert.undici^6.28.0 → ^6.28.1compression→ ^1.8.2 (new)fast-uri3.1.6 → ^3.1.7. The old override pinned the vulnerable version.source-map-js→ ^1.2.2 (new)ip-address10.3.1 → ^10.7.2npm^11.20.0 → ^11.21.1Why the
npmbump matters.npmis pulled in via@deriv-com/quill-ui→quill-tokens→@semantic-release/npm. It bundles its own copies of undici, ip-address, postcss-selector-parser and brace-expansion. Overrides can't reach bundled dependencies, and npm 11.21.1 is the first release that bundles patched versions of all four.Lockfile. Updated with a plain
npm installon top of master's lockfile. The diff is about 100 lines, andsemantic-releasestays in the tree.Removed packages with no patched release
node-forge(high). Came from@rsbuild/plugin-basic-ssl1.x →selfsigned3. The plugin is replaced with a small local equivalent inscripts/rsbuild-plugin-basic-ssl.tsbuilt onselfsigned5, which has no node-forge. The 1.x plugin can't just be overridden, becauseselfsigned5'sgenerate()is async. The dev server still gets a self-signedlocalhostcertificate, reused for 30 days and now signed with SHA-256. It's cached innode_modules/.cache/basic-ssl/.sprintf-js(medium). Came fromargparse1 →js-yaml3, which@istanbuljs/load-nyc-configneeds.js-yaml3 only usesargparsein its CLI binary, so the override now points that path atargparse2, which has no dependencies.Not fixed
braces3.0.3 (high, CVE-2026-93687) is the latest release, and upstream hasn't shipped a fix (micromatch/braces#70). It is used by build and dev tooling (micromatch, chokidar), not by app code.Testing
Run locally on Node 24:
npm cisucceedsnpm startserves https://localhost:8443 with a valid localhost certificate (SAN localhost and 127.0.0.1, 30 days, SHA-256)@istanbuljs/load-nyc-configandjs-yaml3 still load withargparse2npm run buildsucceedsnpm test -- --ci: 25 suites, 311 tests passclaude-reviewis expected to fail. It has been failing on every PR with a 500 from the LiteLLM proxy, which is unrelated to this change.🤖 Generated with Claude Code