fix(security): resolve vulnerable dependencies (security audit #12) - #2869
fix(security): resolve vulnerable dependencies (security audit #12)#2869hanapotski wants to merge 2 commits into
Conversation
Clears all npm audit findings in both workspaces (server 34 -> 0, client 6 -> 0). client/ - npm audit fix (non-breaking): brace-expansion, form-data, js-yaml, postcss, react-router (7.18.1 -> 7.18.2, in-range patch). server/ - npm audit fix (non-breaking): fast-xml-parser (critical), js-yaml, uuid, and the AWS SDK / smithy cluster. - Remove unused `massive` (dead code) which pulled in vulnerable lodash and an outdated pg-promise; declare `pg-promise@^11.15.0` directly (it was previously an undeclared transitive dependency of massive even though db.ts imports it directly). - Remove `mocha` and its only consumer, the orphaned, un-run test/test_neighborhood_service.ts, which pulled in vulnerable serialize-javascript. - aws-service.ts: source the Cognito-pool credential helper from the already-declared @aws-sdk/credential-providers meta-package instead of the standalone @aws-sdk/credential-provider-cognito-identity, which had fallen behind the rest of the SDK. Behavior-preserving (same identity pool, same us-west-2 region). Verified: both workspaces `npm audit` clean; server + client typecheck and build pass; server lint passes; server Jest baseline unchanged (10 pre-existing account snapshot failures, no new failures). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ge-conflict-a64d25 # Conflicts: # server/package-lock.json
```npm audit --production``` in server (for reference while reviewing in dev branch)npm audit reportfast-uri 3.0.0 - 3.1.5 fast-xml-parser <=5.6.0 js-yaml 4.0.0 - 4.3.0 lodash <=4.17.23 pg-promise <11.5.5 qs 2.2.5 - 6.15.3 serialize-javascript <=7.0.4 25 vulnerabilities (20 moderate, 4 high, 1 critical) To address issues that do not require attention, run: To address all issues (including breaking changes), run: ```npm audit --production``` in server (in pr branch)npm audit reportfast-uri 3.0.0 - 3.1.5 fast-xml-parser <=5.6.0 qs 2.2.5 - 6.15.3 19 vulnerabilities (17 moderate, 1 high, 1 critical) To address all issues, run: |
SAUMILDHANKAR
left a comment
SAUMILDHANKAR
left a comment
There was a problem hiding this comment.
Claude teaches me that after the merge commit, fast-xml-parser version was reverted, so npm audit --production still shows critical vulnerability. Another ``npm audit fix``` commit resolves that one atleast.
2 participants
Summary
Resolves item #12 (Vulnerable dependencies) from the security audit. Brings both npm workspaces to a clean
npm audit:Changes
client/
npm audit fixonly (all non-breaking, lockfile-only):brace-expansion,form-data,js-yaml,postcss, andreact-router(7.18.1 → 7.18.2, an in-range patch — no--force/major bump needed).server/
npm audit fix(non-breaking):fast-xml-parser(the critical one),js-yaml,uuid, and the AWS SDK /@smithycluster.massive(unused dead code) — it pulled in a vulnerablelodashand an outdatedpg-promise.pg-promise@^11.15.0as a direct dependency. It had been a phantom dependency:app/services/db.tsimportspg-promisedirectly, but it was only present transitively viamassive. Removingmassiverequired declaring it properly.mochaand its only consumer, the orphaned/un-runserver/test/test_neighborhood_service.ts— it pulled in a vulnerableserialize-javascript.aws-service.ts: sourced the Cognito identity-pool credential helper from the already-declared@aws-sdk/credential-providersmeta-package instead of the standalone@aws-sdk/credential-provider-cognito-identity(two more phantom deps that had been resolving transitively and had fallen behind the rest of the SDK). Behavior-preserving — same identity pool, sameus-west-2region.Verification
npm auditAlso load-smoke-tested the built
db.js(pg-promise 11 initializes cleanly) andaws-service.js.Note for reviewers
The AWS Cognito/Location autocomplete path can't be exercised at runtime without live AWS credentials +
IDENTITY_POOL_ID/PLACE_INDEX_NAME. Typecheck and module-load confirm the API shape, but a live smoke test of address autocomplete in a dev environment before merge would be prudent.🤖 Written by Claude on behalf of @hanapotski
Generated with Claude Code