Skip to content

Bump the npm_and_yarn group across 3 directories with 11 updates - #54

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-754edb3e62
Open

Bump the npm_and_yarn group across 3 directories with 11 updates#54
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-754edb3e62

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
@xmldom/xmldom 0.9.10 0.9.12
brace-expansion 1.1.15 1.1.18
brace-expansion 5.0.7 5.0.9
ip-address 10.2.0 10.7.0
js-yaml 3.15.0 3.15.2
qs 6.15.3 6.16.0
vm2 3.11.5 3.12.2

Bumps the npm_and_yarn group with 8 updates in the /Examples/CodePushDemoApp directory:

Package From To
@xmldom/xmldom 0.9.10 0.9.12
brace-expansion 1.1.15 1.1.18
ip-address 10.2.0 10.7.0
js-yaml 3.15.0 3.15.2
qs 6.15.3 6.16.0
baseline-browser-mapping 2.10.41 2.11.22
browserslist 4.28.4 4.28.9
joi 17.13.4 17.13.8

Bumps the npm_and_yarn group with 8 updates in the /Examples/CodePushDemoAppCpp directory:

Package From To
brace-expansion 1.1.15 1.1.18
ip-address 10.2.0 10.7.0
js-yaml 3.15.0 3.15.2
baseline-browser-mapping 2.10.41 2.11.22
browserslist 4.28.4 4.28.9
joi 17.13.4 17.13.8
fast-uri 3.1.3 3.1.7
fast-xml-parser 5.9.3 5.11.1

Updates @xmldom/xmldom from 0.9.10 to 0.9.12

Release notes

Sourced from @​xmldom/xmldom's releases.

0.9.12

Commits

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
  • Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
  • Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path. GHSA-3px3-54cx-rmw9
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable error in XML, a warning in HTML) instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's onError handler. GHSA-6h8r-xr42-gp59
  • DOMExceptions raised during parsing are now reported as a fatalError, and the originating error is preserved as the cause on the resulting ParseError.

Chore

  • updated dependencies

Thank you, @​ericchiang, @​KarimTantawey, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

Commits

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
  • Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
  • CharacterData nodeValue and data are now kept in sync [#990](https://github.com/xmldom/xmldom/issues/990)

Chore

  • updated dependencies

Thank you, @​bhaswanthc, @​jmestwa-coder, @​stevenobiajulu, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.9.12

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
  • Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
  • Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path. GHSA-3px3-54cx-rmw9
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable error in XML, a warning in HTML) instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's onError handler. GHSA-6h8r-xr42-gp59
  • DOMExceptions raised during parsing are now reported as a fatalError, and the originating error is preserved as the cause on the resulting ParseError.

Chore

  • updated dependencies

Thank you, @​ericchiang, @​KarimTantawey, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.8.15

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

... (truncated)

Commits
  • 0af8cf8 0.9.12
  • 69d257b docs: add 0.9.12 CHANGELOG entry
  • e53e9b1 docs: add 0.8.15 CHANGELOG entry
  • 0748720 fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...
  • 7ced40c fix: prevent HTML raw-text output amplification via case-insensitive close-ta...
  • cfb09b5 fix: prevent quadratic attribute de-duplication via null-prototype membership...
  • e9dbc6b test: characterize NamedNodeMap attribute de-duplication before the index ref...
  • dabffe8 fix: prevent quadratic namespace-map memory consumption via prototype-chain i...
  • 7b2ec67 fix: prevent multiline-anchor bypass of name/id validation by dropping the re...
  • 4664386 fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates brace-expansion from 1.1.15 to 1.1.18

Commits

Updates brace-expansion from 5.0.7 to 5.0.9

Commits

Updates ip-address from 10.2.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • 2b7cab5 10.7.0
  • 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
  • 42c1f8b 10.6.0
  • fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
  • 38b02d7 10.5.1
  • d03e960 Merge commit from fork
  • ab3dc88 Merge commit from fork
  • ef98e0a 10.5.0
  • 9fd1110 Correct the documentation where it disagreed with the library (#219)
  • d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates js-yaml from 3.15.0 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd
Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view

Updates vm2 from 3.11.5 to 3.12.2

Release notes

Sourced from vm2's releases.

v3.12.2

Three advisories closed, and vm2 can now be shipped by single-file bundlers. Patch release — no API changes, with observable behaviour changes for host buffers and host promises handed to the sandbox (see Upgrade Notes).

What's Changed

Security fixes

  • GHSA-5h3f-q97h-ccvc — a NodeVM with a custom require.resolve recorded each resolver answer as a raw string prefix, so resolving an allowlisted package authorized every prefix-sharing sibling beside it (.../node_modules/foo authorized .../node_modules/foo2/index.js), and the {module, path} return shape authorized the whole search directory; under the default context: 'host' the sibling's top-level code ran with host authority. Resolver answers are now recorded as boundary-matched base paths (plus exact extension spellings for extension-probed answers), the object shape authorizes only the resolved package's directory, and an authorization is withdrawn again when its load finds nothing.
  • GHSA-2v2p-6j97-cjg9 — a host promise reaching the sandbox through a constructor return (new HostFn()), a host getter or data property, or a callback argument carried no rejection reaction, so sandbox code that simply dropped it terminated the host process under Node's unhandledRejection policy; the GHSA-gjq8 fix had covered only apply returns. Every host promise is now marked handled once at the single host→sandbox delivery chokepoint (a cheap prototype brand check that never invokes .then on non-promises and recognises promises from a second host realm), and the construct trap carries the same unconditional mark as apply. The sandbox still observes rejections through its own sanitized .catch.
  • GHSA-489w-w794-jq94 — a host-allocated Buffer (a builtin's return value such as zlib.deflateSync, an embedder-supplied buffer, a callback argument) exposed Node's shared 64 KiB allocation pool through .buffer or its legacy twin .parent, letting the sandbox read and overwrite unrelated host buffers — host memory disclosure and corruption. The GHSA-fcqc backing-store ownership rule now applies at the bridge for every host view, keyed on the identity of the delivered value so every alias of the store is covered by one rule; the raw buffer / parent / offset getters are no longer deliverable, the gate fails closed if the bridge cannot resolve ArrayBuffer.isView, and a foreign store planted on a view is refused.

Fixed

  • Single-file bundlers (Bun compile, esbuild, pkg, ...) can now ship vm2. The sandbox bootstrap files had to be read from disk at runtime, so a compiled binary failed with ENOENT as soon as the package directory was not on disk. They are now embedded as string literals in the generated lib/sources.js, and the sandbox-compiled scripts use a fixed virtual filename so bootstrap frames stay redacted from sandbox-visible stack traces.

Maintenance

  • Dev dependency @humanfs/node bumped from 0.16.6 to 0.16.8.

Documentation

  • Categories 46 (custom-resolver sibling authorization, with two documented residuals), 22 (host promises on every delivery route) and 41 (host views and the shared pool, with the observable behaviour changes and two documented residuals) are extended in docs/attacks/, with matching rows in the "How The Bridge Defends" table.

Upgrade Notes

  • Host buffers that do not own their whole backing store are delivered bounded. For such a view, .buffer / .parent is an exact-size copy (not identity-stable, not write-through), and byteOffset / offset read as 0 so Buffer.from(v.buffer, v.byteOffset, v.length) keeps working. Sub-views the sandbox creates from a host-backed buffer lose .buffer aliasing with their parent (index writes still alias), and SharedArrayBuffer sub-views are delivered as copies — hand over a view spanning the whole store for live sharing. Buffers that own their store (Buffer.alloc(n), large buffers) are unchanged.
  • Ignored host promises are silent on every route. Embedders no longer see unhandledRejection for a host promise handed to the sandbox through a getter, callback argument or constructor return, exactly as for call returns since GHSA-gjq8; attach an explicit .catch() to debug rejections.
  • A custom resolver's {module, path} answer must name a package inside path. A module that is absolute, relative or contains .. is now refused and reports module-not-found; return the string shape to name a path directly.
  • Bundling: nothing to configure — lib/sources.js is part of the published package. If you patch a bootstrap file in a fork, run npm run build:sources (or npm test, which regenerates it) so the embedded copy does not go stale.
  • No other valid configurations are affected.

Full Changelog: patriksimek/vm2@v3.12.1...v3.12.2

v3.12.1

Four advisories closed. Patch release — no API changes, with one deliberate behaviour change for NodeVM embedders who granted child_process (see Upgrade Notes).

What's Changed

Security fixes

  • GHSA-6454-5x88-m6jw — an embedder-exposed host Promise could be turned into a sandbox escape. Sandbox code wrote constructor[Symbol.species] onto the raw host promise and then called .then / .catch / .finally with the settlement-direction handler omitted; V8 built the result capability through SpeciesConstructor off the raw object (no bridge trap on that read) and its internal Thrower/Identity reaction delivered the raw host settlement — e.g. process — to a sandbox-captured capability, with no callback slot for the rejection sanitizer to wrap. Host RCE. The bridge now shadows the host promise's constructor for the duration of every sandbox-initiated then / catch / finally call, so the result capability is always a genuine host %Promise%; the indirection peel also covers host Reflect.apply and .finally.
  • GHSA-j89j-5m6r-cr2q — any ordinary sloppy-mode host function exposed to the sandbox leaked the host realm's global object when called with a nullish receiver (greet(), .call(null), Reflect.apply(fn, undefined, []), bind(null)()): V8's OrdinaryCallBindThis substituted the host global for this, and the bridge wrapped and delivered it — greet().process.getBuiltinModule('child_process') was host RCE. The host global is now cached at bridge init and refused at every host→sandbox coercion chokepoint, delivered as undefined, which is exactly what a strict-mode function's this already looked like.
  • GHSA-x3v6-43hc-82mc — a NodeVM that allowlisted the crypto builtin let guest code call crypto.setFips, flipping the FIPS mode of the entire host process; the read-only wrap stops property writes but forwards host calls with full authority. Same process-wide-mutator class as crypto.setEngine (GHSA-46pr) and tls.setDefaultCACertificates (GHSA-98xx). setFips is now replaced with a throwing stub alongside setEngine; getFips() and the rest of crypto are unchanged. Configuration-integrity issue, not RCE.
  • GHSA-pq68-rvw4-xp4r — NodeVM's hard denylist blocked every other host-process launcher (cluster, worker_threads, node:test) but omitted child_process, so require: { builtin: ['*'] }, ['*', '-fs'], an explicit ['child_process'], and the node: spellings all handed the sandbox the real host module — one execSync call was host RCE. child_process now joins DANGEROUS_BUILTINS: filtered from the wildcard, refused on explicit request, and covered by the node: / family normalization.

Documentation

  • The attack catalog is now split by mechanism family: docs/ATTACKS.md is the index and common material, and each family lives under docs/attacks/. Category numbers are permanent and unchanged. test/docs-catalog.js fails the suite on a renumbering, a dead link, or a missing metadata line.
  • New Categories 53 (host-Promise @@species hijack with a missing handler) and 54 (host global leak via a sloppy function's nullish this), plus extensions to Categories 21 (child_process joins the denylist, with the upgrade path) and 40 (crypto.setFips), and matching rows in the "How The Bridge Defends" table.

... (truncated)

Changelog

Sourced from vm2's changelog.

[3.12.2]

Security fixes

  • GHSA-5h3f-q97h-ccvc — NodeVM custom-resolver authorization admitted prefix-sharing siblings: resolving an allowlisted package recorded a raw ^<path> prefix, so .../node_modules/foo authorized .../node_modules/foo2/index.js (and the {module, path} shape authorized the whole search directory), running the sibling's top-level code in the host realm under context: 'host'. Structural fix in lib/resolver-compat.js: resolver answers are recorded as boundary-matched base paths (plus exact extension spellings), the object shape authorizes only the resolved package directory, and a failed load withdraws its authorization. Behavior change: a {module, path} answer whose module is absolute, relative or contains .. is now refused. See ATTACKS.md Category 46 and test/ghsa/GHSA-5h3f-q97h-ccvc/.
  • GHSA-2v2p-6j97-cjg9 — a host promise delivered into the sandbox through a constructor return, a host getter or data property, or a callback argument carried no rejection reaction, so sandbox code that dropped it terminated the host process under Node's unhandledRejection policy (GHSA-gjq8-xm47-88rc covered only apply returns). Structural fix in lib/bridge.js: every host promise is marked handled once at the delivery chokepoint (prototype brand check, cross-realm aware), and the construct trap gains the same unconditional mark as apply. Behavior change: embedders no longer see unhandledRejection for host promises handed to the sandbox on any route; debug rejections need an explicit .catch(). See ATTACKS.md Category 22 and test/ghsa/GHSA-2v2p-6j97-cjg9/.
  • GHSA-489w-w794-jq94 — host memory disclosure and corruption: a host-allocated Buffer (a builtin's return value such as zlib.deflateSync, an embedder-supplied buffer, a callback argument) exposed Node's shared 64 KiB pool through .buffer / .parent, letting the sandbox read and overwrite unrelated host buffers. Structural fix in lib/bridge.js: the GHSA-fcqc backing-store ownership rule now applies at the bridge for every host view, keyed on the delivered value's identity (so every alias of the store is covered), with the raw buffer / parent / offset getters undeliverable and a fail-closed gate. Behavior change: for a host view that does not own its whole store, .buffer / .parent is a bounded copy (not identity-stable, not write-through), byteOffset / offset read as 0, sandbox-created sub-views lose .buffer aliasing with their parent, and SharedArrayBuffer sub-views are delivered as copies; owning buffers are unchanged. See ATTACKS.md Category 41 and test/ghsa/GHSA-489w-w794-jq94/.

Fixed

  • Single-file bundlers (Bun compile, esbuild, pkg, ...) can now ship vm2. The sandbox bootstrap files (bridge.js, setup-sandbox.js, setup-node-sandbox.js, events.js) must reach the sandbox realm as source text and were read from disk at runtime with fs.readFileSync(\${__dirname}/...`), which a bundler cannot follow — a compiled binary failed with ENOENTas soon as the package directory was not on disk. They are now embedded as string literals in the generatedlib/sources.js (npm run build:sources, regenerated by pretest/prepublishOnlyand guarded by a staleness test). The sandbox-compiled scripts use the fixed virtual filename/vm2/lib/` instead of the host install path, so bootstrap frames stay redacted from sandbox-visible stack traces.

Maintenance

  • Dev dependency @humanfs/node bumped from 0.16.6 to 0.16.8.

[3.12.1]

Security fixes

  • GHSA-6454-5x88-m6jw — sandbox-to-host RCE through an embedder-exposed host Promise. Writing constructor[Symbol.species] on the raw host promise and calling .then / .catch / .finally with the settlement-direction handler omitted made V8 deliver the raw host settlement (e.g. process) to a sandbox-captured capability, with no callback slot for the rejection sanitizer to wrap. Structural fix in lib/bridge.js: neutralizeHostPromiseSpeciesOn shadows the host promise's constructor across the call so the result capability is always a genuine host %Promise%, and the indirection peel now also covers host Reflect.apply and .finally. See ATTACKS.md Category 53 and test/ghsa/GHSA-6454-5x88-m6jw/.
  • GHSA-j89j-5m6r-cr2q — sandbox escape to host RCE through any embedder-exposed sloppy-mode host function. Calling it with a nullish receiver (greet(), .call(null), Reflect.apply(fn, undefined, []), bind(null)()) makes V8 bind this to the host realm's global object, which the bridge then wrapped and delivered to the sandbox (greet().process.getBuiltinModule('child_process')). Structural fix in lib/bridge.js: the host global is cached at bridge init and refused at the three host→sandbox coercion chokepoints, returning undefined so strict-function semantics are preserved. See ATTACKS.md Category 54 and test/ghsa/GHSA-j89j-5m6r-cr2q/.
  • GHSA-x3v6-43hc-82mc — a NodeVM that allowlists the crypto builtin let guest code call crypto.setFips, flipping the FIPS mode of the entire host process; the read-only wrap stops property writes but forwards host calls with full authority, the same process-wide-mutator class as crypto.setEngine and tls.setDefaultCACertificates. Fix in lib/builtin.js: sanitizeCryptoModule replaces setFips with a throwing stub alongside setEngine; getFips() and the rest of crypto are untouched. Configuration-integrity issue, not RCE. See ATTACKS.md Category 40 and test/ghsa/GHSA-x3v6-43hc-82mc/.
  • GHSA-pq68-rvw4-xp4r — NodeVM's hard denylist omitted child_process, so require: { builtin: ['*'] }, ['*', '-fs'], an explicit ['child_process'], and the node: spellings all handed the sandbox the real host module and one execSync call was host RCE. Fix in lib/builtin.js: child_process joins DANGEROUS_BUILTINS, denied under the wildcard and on explicit request like cluster / worker_threads / node:test. Behavior change: embedders running trusted scripts that need it re-expose it through require.mock (the real module or a narrower facade); a bare builtin: ['child_process'] no longer grants it. See ATTACKS.md Category 21 and test/ghsa/GHSA-pq68-rvw4-xp4r/.

[3.12.0]

Added

  • Experimental Bun support (test suite and CI only). The suite now runs under Bun, with engine-keyed assertion messages so patterns stay exactly as strict on Node, a central test/bun-skips.js listing every JavaScriptCore divergence, and a non-blocking CI job whose output is verified complete before it is believed. Bun is not a supported security boundary — vm2's threat model is derived from V8 internals and JavaScriptCore has not been audited against the bridge. See the README Runtimes section.

Maintenance

  • global.Proxy install guarded for JavaScriptCore, and the sealed-slot attributes left implicit — lib/setup-sandbox.js installs the handler-sanitising Proxy with a bare assignment to a slot the Object.defineProperties(global, ...) block above declares as undefined. What that write does is engine-specific: on Node >= 10 the slot is genuinely sealed and the write is a silent no-op, so the sandbox has no Proxy at all; on Node 8 the old V8 global proxy leaves the slot writable and the write is live, which is what gives that sandbox its Proxy; and JavaScriptCore (Bun) implements the strict-mode write correctly and throws, aborting sandbox setup before the first run(). The write is now wrapped in try/catch — the failure outcome is "no Proxy in the sandbox", which is strictly more restrictive, never less. test/vm.js gains an AST-based guard (via acorn, already a runtime dependency) that fails if any write to Error, Promise or Proxy is left outside a try block, including through a local alias, and pins the sealed-slot descriptors on Node >= 10 where the seal actually takes. Correction to 3.11.8's entry: that release described the assignment as dead code and removed it, and separately spelled out writable: false, configurable: false on the three sealed slots for readability, claiming no behaviour change. The second change was the damaging one — those attributes are the spec defaults, so the forms are equivalent on a current V8 but not on the Node 8 global proxy, where only the explicit form actually seals the slot. That silently removed Proxy from Node 8 sandboxes and broke six tests. The attributes are omitted again, with a comment saying why they must stay that way, and the assignment is restored.

[3.11.8]

Security fixes

  • GHSA-3vgf-8m4q-q4qr (dup: GHSA-59g5-pmg6-5gr4) — default VM host intrinsic prototype pollution of the binary-data and iterator families. The protected inventory omitted ArrayBuffer / SharedArrayBuffer / DataView / every TypedArray / the abstract %TypedArray%.prototype, and the array/string/map/set/regexp-string iterator prototypes plus the shared %IteratorPrototype%. Because Buffer extends Uint8Array, the Category 20 proto-walk from a host Buffer reached those unprotected host prototypes and Reflect.defineProperty polluted them globally, corrupting every host-realm typed array and iterator. lib/bridge.js now lists the binary-data globals in globalsList and resolves the abstract intrinsic prototypes structurally into thisGlobalPrototypes, routing all of them into protectedHostObjects, the proto-mapping table, and the identity map so the write traps refuse sandbox set/defineProperty. See ATTACKS.md Category 20 (extended) and test/ghsa/GHSA-3vgf-8m4q-q4qr/.
  • GHSA-88hf-g992-jg85 — NodeVM default-config (console: 'inherit') sandbox escape. The sandbox extracted the raw host Object.prototype.__proto__ getter (via Buffer.call.call(__lookupGetter__, …, '__proto__'), the GHSA-v6mx/cfcw primitive) and, because that getter was never classified dangerous like the setter, climbed console._stdout's host prototype chain to the non-intrinsic EventEmitter.prototype, overwrote emit, and had the host invoke it with this === process → RCE. Closed with two independent layers in lib/bridge.js: (1) the raw host proto-readers (__proto__ getter, Object.getPrototypeOf, Reflect.getPrototypeOf) are denied delivery at thisFromOtherWithFactory/thisEnsureThis/thisFromOtherForThrow and the apply trap, so the sandbox can no longer climb host chains; (2) host [[Prototype]] objects are marked at delivery and sandbox function/accessor writes to them are diverted off the raw host object in BaseHandler.set/defineProperty. Legitimate Object.getPrototypeOf on host proxies and data/leaf writes are unchanged. See ATTACKS.md Category 50 and test/ghsa/GHSA-88hf-g992-jg85/.
  • GHSA-f8gf-w286-fmq2 — ...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group across 3 directories with 11 updates
3d51f24 
Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.9.10` | `0.9.12` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.18` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.7` | `5.0.9` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.0` | `3.15.2` |
| [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.16.0` |
| [vm2](https://github.com/patriksimek/vm2) | `3.11.5` | `3.12.2` |

Bumps the npm_and_yarn group with 8 updates in the /Examples/CodePushDemoApp directory:

| Package | From | To |
| --- | --- | --- |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.9.10` | `0.9.12` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.18` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.0` | `3.15.2` |
| [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.16.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.41` | `2.11.22` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.4` | `4.28.9` |
| [joi](https://github.com/hapijs/joi) | `17.13.4` | `17.13.8` |

Bumps the npm_and_yarn group with 8 updates in the /Examples/CodePushDemoAppCpp directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.18` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.0` | `3.15.2` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.41` | `2.11.22` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.4` | `4.28.9` |
| [joi](https://github.com/hapijs/joi) | `17.13.4` | `17.13.8` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.7` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.9.3` | `5.11.1` |



Updates `@xmldom/xmldom` from 0.9.10 to 0.9.12
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.9.10...0.9.12)

Updates `brace-expansion` from 1.1.15 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `brace-expansion` from 5.0.7 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `ip-address` from 10.2.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0)

Updates `js-yaml` from 3.15.0 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.0...3.15.2)

Updates `qs` from 6.15.3 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.3...v6.16.0)

Updates `vm2` from 3.11.5 to 3.12.2
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md)
- [Commits](patriksimek/vm2@v3.11.5...v3.12.2)

Updates `@xmldom/xmldom` from 0.9.10 to 0.9.12
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.9.10...0.9.12)

Updates `brace-expansion` from 1.1.15 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `ip-address` from 10.2.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0)

Updates `js-yaml` from 3.15.0 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.0...3.15.2)

Updates `qs` from 6.15.3 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.3...v6.16.0)

Updates `baseline-browser-mapping` from 2.10.41 to 2.11.22
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.41...v2.11.22)

Updates `browserslist` from 4.28.4 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.4...4.28.9)

Updates `joi` from 17.13.4 to 17.13.8
- [Commits](hapijs/joi@v17.13.4...v17.13.8)

Updates `brace-expansion` from 1.1.15 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `ip-address` from 10.2.0 to 10.7.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0)

Updates `js-yaml` from 3.15.0 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.0...3.15.2)

Updates `baseline-browser-mapping` from 2.10.41 to 2.11.22
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.41...v2.11.22)

Updates `browserslist` from 4.28.4 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.4...4.28.9)

Updates `joi` from 17.13.4 to 17.13.8
- [Commits](hapijs/joi@v17.13.4...v17.13.8)

Updates `fast-uri` from 3.1.3 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.7)

Updates `fast-xml-parser` from 5.9.3 to 5.11.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.9.3...v5.11.1)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.9.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vm2
  dependency-version: 3.12.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.9.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.11.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants