fix(deps): override adm-zip to ^0.6.0 (clears GHSA-xcpc-8h2w-3j85, high) - #19
Closed
tashaamanda wants to merge 2 commits into
Closed
tashaamanda wants to merge 2 commits into
tashaamanda wants to merge 2 commits into
Conversation
…igh) adm-zip <0.6.0 (pulled transitively via @huggingface/transformers -> onnxruntime-node) is vulnerable to a crafted-ZIP 4GB memory allocation (GHSA-xcpc-8h2w-3j85, high). onnxruntime-node pins adm-zip ^0.5.16, so an overrides entry forces the patched 0.6.0 without the breaking @huggingface/transformers downgrade that `npm audit fix --force` proposes. Validation: npm audit reports 0 vulnerabilities; the lockfile resolves adm-zip solely to 0.6.0; onnxruntime-node uses only new AdmZip() and extractEntryTo(), both stable in 0.6.0. Two-file change (package.json + package-lock.json). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Superseded — reopening a clean PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Force the transitive dependency
adm-zipup to the patched^0.6.0via anoverridesentry.Why
adm-zip <0.6.0— pulled in through@huggingface/transformers → onnxruntime-node— is vulnerable to GHSA-xcpc-8h2w-3j85 (crafted ZIP triggers a 4GB memory allocation, high).onnxruntime-nodepinsadm-zip ^0.5.16, so it can't be bumped in place;npm audit fix --force"resolves" it only by downgrading@huggingface/transformers 4.2.0 → 3.8.1(a breaking major that changes the local-embeddings path). Anoverridesentry forces the patched0.6.0without that downgrade.Validation
npm audit→ 0 vulnerabilities (was 3 high)adm-zipsolely to0.6.0onnxruntime-nodeuses onlynew AdmZip()+extractEntryTo(), both stable in 0.6.0package.json(+1 override) andpackage-lock.json(adm-zip 0.5.17 → 0.6.0)Scope
Deliberately excludes the separate
sharp/ Node-26 install issue (preexisting upstream; CI pins Node ≤22). The open Dependabot PRs (#17, #18, #13, #11) should rebase on top of this.🤖 Generated with Claude Code