fix(deps): bump hono, tar, dompurify, sharp to patch known CVEs - #3807
Open
aeonframework wants to merge 1 commit into
Open
fix(deps): bump hono, tar, dompurify, sharp to patch known CVEs#3807aeonframework wants to merge 1 commit into
aeonframework wants to merge 1 commit into
Conversation
hono 4.0.0/4.6.0 -> 4.13.5: closes 19 GHSA advisories (highest: GHSA-88fw-hqm2-52qc, CORS middleware credential-reflection, HIGH) across cli/engine/gcp-cloud-run/ producer/studio-server. None of the vulnerable middleware (cors/jwt/serve-static/ lambda adapters) is imported by this repo's own code, but hono is the HTTP framework underpinning every network-facing surface (Studio/CLI preview server, Cloud Run distributed-render handler), so keeping it current is defense-in-depth. tar 7.4.3 -> 7.5.21 (aws-lambda, gcp-cloud-run): closes 6 advisories including GHSA-23hp-3jrh-7fpw (CRITICAL). Used to pack/unpack distributed-render artifacts. dompurify 3.2.4 -> 3.4.13 (studio): closes 3 advisories (moderate sanitizer-bypass class). The one call site (StoryboardSourceEditor markdown preview) doesn't use the vulnerable IN_PLACE/setConfig()+uponSanitizeAttribute patterns, so not independently confirmed reachable here, but this is the project's XSS sanitizer. sharp 0.35.0 -> 0.35.4 (cli): closes GHSA-rgj7-g3m4-5g8c (HIGH). All four targets OSV-verified clean at the bumped version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency bump to address several disclosed CVEs found via
osv-scanner.Packages bumped
hono^4.0.0/^4.6.0(cli, engine, gcp-cloud-run, producer, studio-server)^4.13.5tar^7.4.3(aws-lambda, gcp-cloud-run)^7.5.21dompurify^3.2.4(studio)^3.4.13sharp^0.35.0(cli)^0.35.4All four target versions are OSV-verified clean (
api.osv.devquery against the bumped version returns zero vulnerabilities) and stay within the current major, so this should be a drop-in bump.Reachability notes
hono/cors,hono/jwt,serve-static, the AWS Lambda / Lambda@Edge adapters) — grepped the wholepackages/*/srctree and found no usage. hono is still the HTTP framework underpinning every network-facing surface here (the Studio/CLI preview server, the Cloud Run distributed-render handler), so this is defense-in-depth rather than a confirmed-reachable fix.aws-lambda/gcp-cloud-runto pack/unpack distributed-render artifacts — a real, shipped runtime path.packages/studio/src/components/storyboard/StoryboardSourceEditor.tsx's markdown preview). Checked the one call site against the three advisories' preconditions — it callsDOMPurify.sanitize(html)with noIN_PLACEoption and nosetConfig()/uponSanitizeAttributehook, so it isn't hit by any of the three bypass classes today. Bumping anyway since it's the sanitizer of record.Not bumped
adm-zip@0.6.0also has an open advisory (GHSA-vwc7-r8mq-g2x9, extraction follows destination symlinks) but no fixed version exists yet upstream — nothing to bump to, flagging for awareness only.Caveat
Manifest-only (
package.json) —bun/bun installwasn't available in this run's sandbox to regeneratebun.lock. Please runbun install(root) to refresh the lockfile; the caret ranges above already resolve to a clean version once regenerated.Detected by osv-scanner, cross-checked against
api.osv.dev. No code changes outside dependency manifests.Filed by Aeon.