From b8c34645c9b377bc1fa0a74c9b45b649b44bbbd4 Mon Sep 17 00:00:00 2001 From: Kevin Codex Date: Thu, 25 Jun 2026 09:26:11 +0800 Subject: [PATCH] =?UTF-8?q?chore(deps):=20clean=20npm=20install=20?= =?UTF-8?q?=E2=80=94=20fix=20CVEs,=20silence=20warnings=20(#1782)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore(deps): clean npm install — fix CVEs, silence warnings - bump undici 7.24.6 → 7.28.0 (7 high CVEs: TLS bypass, header injection, DoS, cache poisoning, SameSite downgrade, cross-origin routing) - bump ws 8.20.0 → 8.21.0 (2 high CVEs: uninitialized memory disclosure, memory exhaustion DoS) - add allowScripts for sharp + protobufjs to silence install-script warnings - vendor node-domexception shim (re-exports native DOMException) and override the deprecated polyfill pulled transitively by google-auth-library → gaxios → node-fetch@3 → fetch-blob Result: `npm install` reports 0 vulnerabilities, 0 warnings. Co-Authored-By: OpenClaude * chore(deps): update bun.lock for undici/ws bumps and node-domexception override CI runs `bun install --frozen-lockfile`, which requires bun.lock to match package.json. The previous commit bumped undici/ws and added the node-domexception shim override but didn't include the regenerated lockfile, causing frozen-lockfile CI to fail. Co-Authored-By: OpenClaude * fix(publish): include vendor/node-domexception-shim in npm tarball The file: override in package.json points at vendor/node-domexception-shim, but the files array didn't list vendor/, so npm pack excluded it. End-user npm installs would fail resolving the override. Add vendor/node-domexception-shim/ to the files array. Verified via npm pack --dry-run: tarball now contains both shim files (12 → 14 files). Addresses reviewer finding #1. Co-Authored-By: OpenClaude --------- Co-authored-by: OpenClaude --- bun.lock | 13 +++++++------ package.json | 12 +++++++++--- vendor/node-domexception-shim/index.js | 3 +++ vendor/node-domexception-shim/package.json | 8 ++++++++ 4 files changed, 27 insertions(+), 9 deletions(-) create mode 100644 vendor/node-domexception-shim/index.js create mode 100644 vendor/node-domexception-shim/package.json diff --git a/bun.lock b/bun.lock index 31a1eb1f8..719109cf1 100644 --- a/bun.lock +++ b/bun.lock @@ -59,11 +59,11 @@ "tree-kill": "1.2.2", "turndown": "7.2.2", "type-fest": "4.41.0", - "undici": "7.24.6", + "undici": "7.28.0", "usehooks-ts": "3.1.1", "vscode-languageserver-protocol": "3.17.5", "wrap-ansi": "9.0.2", - "ws": "8.20.0", + "ws": "8.21.0", "xss": "1.0.15", "yaml": "2.8.3", "zod": "3.25.76", @@ -81,6 +81,7 @@ "google-auth-library": "10.6.2", "ip-address": "10.2.0", "lodash-es": "4.18.1", + "node-domexception": "file:vendor/node-domexception-shim", }, "packages": { "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.3.0", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA=="], @@ -739,8 +740,6 @@ "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="], - "node-domexception": ["node-domexception@1.0.0", "", {}, "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ=="], - "node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="], "node-forge": ["node-forge@1.4.0", "", {}, "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ=="], @@ -907,7 +906,7 @@ "unbash": ["unbash@3.0.0", "", {}, "sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA=="], - "undici": ["undici@7.24.6", "", {}, "sha512-Xi4agocCbRzt0yYMZGMA6ApD7gvtUFaxm4ZmeacWI4cZxaF6C+8I8QfofC20NAePiB/IcvZmzkJ7XPa471AEtA=="], + "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="], "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="], @@ -937,7 +936,7 @@ "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="], - "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="], + "ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="], "xml-naming": ["xml-naming@0.1.0", "", {}, "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw=="], @@ -1215,6 +1214,8 @@ "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="], + "fetch-blob/node-domexception": ["node-domexception@file:vendor/node-domexception-shim", {}], + "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="], "knip/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="], diff --git a/package.json b/package.json index f3f9e6481..37a87f457 100644 --- a/package.json +++ b/package.json @@ -21,6 +21,7 @@ "src/entrypoints/sdk.d.ts", "src/entrypoints/sdk/coreTypes.generated.ts", "scripts/windows/openclaude-aliases.ps1", + "vendor/node-domexception-shim/", "docs/windows-aliases-and-launchers.md", "README.md" ], @@ -128,11 +129,11 @@ "tree-kill": "1.2.2", "turndown": "7.2.2", "type-fest": "4.41.0", - "undici": "7.24.6", + "undici": "7.28.0", "usehooks-ts": "3.1.1", "vscode-languageserver-protocol": "3.17.5", "wrap-ansi": "9.0.2", - "ws": "8.20.0", + "ws": "8.21.0", "xss": "1.0.15", "yaml": "2.8.3", "zod": "3.25.76" @@ -168,6 +169,11 @@ "overrides": { "ip-address": "10.2.0", "google-auth-library": "10.6.2", - "lodash-es": "4.18.1" + "lodash-es": "4.18.1", + "node-domexception": "file:vendor/node-domexception-shim" + }, + "allowScripts": { + "protobufjs@7.6.4": true, + "sharp@0.34.5": true } } diff --git a/vendor/node-domexception-shim/index.js b/vendor/node-domexception-shim/index.js new file mode 100644 index 000000000..c4f8d4773 --- /dev/null +++ b/vendor/node-domexception-shim/index.js @@ -0,0 +1,3 @@ +/*! node-domexception shim. Re-exports the platform-native DOMException. */ + +module.exports = globalThis.DOMException diff --git a/vendor/node-domexception-shim/package.json b/vendor/node-domexception-shim/package.json new file mode 100644 index 000000000..762db1437 --- /dev/null +++ b/vendor/node-domexception-shim/package.json @@ -0,0 +1,8 @@ +{ + "name": "node-domexception", + "version": "1.0.0", + "description": "Stub shim: re-exports the platform-native DOMException. Replaces the deprecated node-domexception polyfill.", + "main": "index.js", + "type": "commonjs", + "license": "MIT" +}