Repository navigation
fix(security): Snyk Code findings; React 19.3.1 - #1861
Merged
Merged
Conversation
Snyk Code reported 14 findings on main: - the engine's input file name took its extension from the user's file name: every engine file name now uses a letters-and-digits extension; - the service worker accepted messages from any origin: it now ignores other origins; - strip-sourcemaps.mjs (which deletes files) and build-sw-manifest.mjs took a directory from the command line: both refuse one outside the repository; - check-deploy.mjs's summary had an object key named "pass", read as a hardcoded password: keys are the RESULT constants; - test-only code (unit and browser tests, the local test server) is excluded from Snyk Code in .snyk. The other two (Cache.match "ReDoS" in sw.js, the dedicated worker's message handler) are false positives, ignored in Snyk with reasons. React and react-dom go to 19.3.1 together, with @types/react and @types/react-dom 19.3.0, superseding the Snyk and Dependabot PRs that bumped them one at a time without updating bun.lock.
✅ Deploy Preview for reframe-os ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This was referenced Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR resolves Snyk Code's 14 findings on main (
d1ff303) and replaces Snyk's and Dependabot's one-package React upgrade PRs, whose checks fail.Snyk Code findings
ffmpeg.worker.ts: the engine's input and overlay file names took their extension straight from the user's file namesafeExtension()keeps letters and digits only (max 8), with a fallback. Every engine file name (export, overlay, frames, join) uses it. A worker test feeds../../etc/holiday.mp4/..and checks no written name contains/or...sw.jsmessage handlerstrip-sourcemaps.mjs(deletes files),build-sw-manifest.mjs: a directory from argvout/, including Netlify's command.check-deploy.mjs: an object key namedpassRESULTconstants.scripts/serve-isolated.mjs(local test server on 127.0.0.1),deployCheck.test.tsfixtureexclude: code:in.snyk(tests/**,__tests__/**,test/**, the test server).sw.jscache.match(request.url)ffmpeg.worker.tshandlerThe triage is recorded in
docs/SECURITY-PIPELINE.md, which also gets a new section on how Snyk is connected.React 19.3.1
reactandreact-dom19.3.1 move together, with@types/reactand@types/react-dom19.3.0 in bothdevDependenciesandoverrides.bun.lockchanges for those four packages only.This makes the following PRs obsolete: Snyk's #1852, #1853, #1826, #1805 and #1801, and Dependabot's #1794. Each bumped one package without the other and without
bun.lock, sonpmcouldn't resolve the tree ("ERESOLVE") and the Dependency scan failed, along with every check that needs a frozen lockfile.Tests
strip-sourcemaps.mjswas checked onout/(removes the maps) and on/tmp(refuses).