security: npm overrides for transitive dev-only deps#45
security: npm overrides for transitive dev-only deps#45lavacakechef wants to merge 1 commit intomainfrom
Conversation
Adds package.json `overrides` for ~35 transitive packages flagged by Dependabot. All affected packages are dev/build tooling (hardhat plugins, ganache, web3 stack); none are imported into the compiled Solidity bytecode of CPOOL or its OFT bridges, and none run in production. The overrides ensure top-level resolution to patched versions; a small number of legacy nested copies (e.g. `request/node_modules/[email protected]`, `ganache/node_modules/[email protected]`) remain because npm overrides won't cross major versions in deep nested paths — those will be dismissed as tolerable_risk in a follow-up since the affected code never runs. Resolves the bulk of Dependabot alerts on this repo: handlebars (critical #173, high #170-#172, #174, medium #168, #167), sha.js #127, cipher-base #126, pbkdf2 #145+#121, path-to-regexp #112+#101+#176, form-data top-level #124+#123, undici #136+#118+#113+#91+#90+#164-#167, ws #95+#94, tar (#138-#163 series), minimatch (#153-#158), brace-expansion #169+#120, picomatch #182+#183, lodash #181+#180+#141, lodash.template #179+#93, elliptic top-level #114+#107+#110+#99+#98+#97+#135 (note: ganache-nested 6.5.4 unresolved), serialize-javascript #116+#159+#175, immutable #162, base-x #117, bn.js #152+#151, secp256k1 top-level #109, qs #144+#134, ajv #150, js-yaml #132, follow-redirects #184, nanoid #111, tough-cookie #69, tmp #125, yargs-parser top-level #4 (legacy nested 2.4.1 in @ensdomains/ens unresolved), diff #139, min-document #130, cookie #106, serve-static #104, send #105, express #103, body-parser #102, micromatch #100, ansi-regex #38+#36, uuid #185. Unfixable (dismiss as tolerable_risk in follow-up): - #135 elliptic risky-primitive (no patch available) - #93 lodash.template command injection (no patch — package deprecated) - #66 request SSRF (no patch — package deprecated) - #128 web3-core-subscriptions, #129 web3-core-method (no patch)
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 49 minutes and 52 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Adds
overridesfor ~35 transitive packages flagged by Dependabot. All flagged packages are dev/build tooling (hardhat plugins, ganache, the web3.js v1 stack); none are imported into compiled Solidity bytecode and none run in production. The override block forces resolution to patched versions; lockfile regenerated.Why this approach
Per npm RFC 0036 and GitHub's Dependabot guidance, the canonical fix for transitive vulns is
overrides/resolutionsrather than 30+ individual Dependabot PRs. Cleaning the dashboard in one shot also makes future real signals visible.Resolves
Bulk-resolves: handlebars (critical #173, high ×4), sha.js #127, cipher-base #126, pbkdf2 ×2, path-to-regexp ×3, undici ×7, ws ×2, tar ×8 series, minimatch ×6, brace-expansion ×2, picomatch ×2, lodash ×3, elliptic top-level ×7, serialize-javascript ×3, immutable, base-x, bn.js ×2, secp256k1 top-level, qs ×2, ajv, js-yaml, follow-redirects, nanoid, tough-cookie, tmp, yargs-parser top-level, diff, min-document, cookie, serve-static, send, express, body-parser, micromatch, ansi-regex ×2, uuid, form-data top-level. ~70 alerts.
Known remainders (will dismiss as tolerable_risk)
request/node_modules/[email protected],ganache/node_modules/[email protected],@ensdomains/ens/node_modules/[email protected]. Those packages are deprecated upstream and never run.dismiss: tolerable_risk.Test plan
npx hardhat compilesucceeds🤖 Generated with Claude Code