Bump vulnerable deps flagged by Component Governance - #27757
Merged
kian-thompson merged 13 commits intoJul 27, 2026
Conversation
Address 33 Component Governance alerts by updating pnpm-workspace overrides (manifest-only; lockfile regeneration to follow): Root pnpm-workspace.yaml: - axios@<1: ^0.32.0 -> ^0.33.0 (CVE-2026-44486/87/90/92, GHSA-gcfj-64vw-6mp9) - axios@^1.15.0: 1.16.0 -> ^1.18.1 (GHSA-gcfj/jqh4/mmx7/7q8q/mwf2/f4gw/xj6q) - brace-expansion@>=5 <6: ^5.0.6 -> ^5.0.7 (CVE-2026-13149) - brace-expansion@>=1 <2: ^1.1.16 (new) (CVE-2026-13149) - brace-expansion@>=2 <3: ^2.1.2 (new) (CVE-2026-13149) - js-yaml@>=3 <4: ^3.15.0 (new) (CVE-2026-59869) - js-yaml@>=4 <5: ^4.3.0 (new) (CVE-2026-59869) - webpack@>=5 <6: ^5.104.1 (new) (CVE-2025-68157/68458) - websocket-driver@>=0 <1: ^0.7.5 (new) (CVE-2026-54466/54490) - fast-uri: ^3.1.2 -> ^4.1.1 (CVE-2026-16221) packages/test/test-version-utils/compat-workspaces/full/pnpm-workspace.yaml: - axios@<1: ^0.31.1 -> ^0.33.0 - axios@>=1 <2: ^1.15.2 -> ^1.18.1 - brace-expansion@>=1<2, >=2<3, >=5<6 (new) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Regenerated root and compat-workspaces/full lockfiles to pick up the override changes in the previous commit. Confirmed no packagefeedproxy or ms-feed-* tarball URLs were introduced. Notable resolved versions: - axios: 0.33.0 and 1.18.1 - brace-expansion: 1.1.16, 2.1.2, 5.0.7 - js-yaml: 3.15.0, 4.3.0 - webpack: 5.109.0 - websocket-driver: 0.7.5 - fast-uri: 4.1.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Address CG alerts on webpack-dev-server 4.15.2 (CVE-2025-30359, CVE-2025-30360, CVE-2026-6402, CVE-2026-9595, CVE-2026-14620, CVE-2026-14631). All patched in 5.2.6. The v4 -> v5 upgrade is drop-in for this repo: - Repo already requires node >=22 (v5 requires >=18.12) - Webpack is already ^5.94.0 (v5 requires >=5) - All 42 webpack.config.cjs files already use setupMiddlewares; none use the removed onBefore/onAfterSetupMiddleware, http2, or https:{} options. Updated 41 package.json files (examples/**, devtools-test-app) and regenerated the root lockfile; verified no packagefeedproxy/ms-feed-* tarball URLs. Smoke-tested config load with wds@5.2.6. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
morgan 1.11.0 neutralizes CR/LF in the :remote-user token, resolving the log-forging CVE affecting 1.2.0 through 1.10.1. Updated tinylicious and services-utils; regenerated server/routerlicious/pnpm-lock.yaml (verified no proxy/tarball URLs). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The alert on uuid@3.4.0 in server/routerlicious, server/gitrest, and server/historian is transitive from kafka-node@5.0.0. kafka-node declares uuid@^3.0.0 in its package.json but does not import it in any .js file (dead dependency), so overriding to the patched 11.x line is safe API-wise. Complements the existing uuid@>=7 <12 -> ^11.1.1 override in each server pnpm-workspace.yaml. Lockfiles regenerated (no proxy/tarball URLs). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
area: examples
Contributor
|
Hi! Thank you for opening this PR. Want me to review it? Based on the diff (12764 lines, 59 files), I've queued these reviewers:
How this works
|
moniker (Creative Commons Attribution-NoDerivatives license) is flagged by Component Governance as a legal-compliance issue. The three package.json `browser` aliases mapping `moniker` -> `@fluidframework/server-services-client/dist/generateNames.js` are dead code — no source in webpack-fluid-loader, local-driver, or memory-orderer imports `moniker`, and the current name-generation path already uses `sillyname` via `@fluidframework/server-services-client`. Remove them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5e47fcd1-edae-44de-a5e8-7361327091dc
Restore intentional exact-pin discipline for supply-chain-sensitive packages: - axios@^1.15.0 override: ^1.18.1 -> 1.18.1 (exact) - axios@>=1<2 in compat-workspaces: ^1.18.1 -> 1.18.1 (exact) - webpack-dev-server direct dep: ^5.2.6 -> ~5.2.6 (tilde) across 41 example/tool packages The exact axios pin matches the pre-existing convention (see the axios supply-chain compromise notes and neverBuiltDependencies list in the root pnpm-workspace.yaml). Lockfiles regenerated; resolved versions unchanged (axios 1.18.1, webpack-dev-server 5.2.6). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
webpack-dev-server@5.x .d.ts references open@10 (ESM-only), which trips TS1479 for the two packages that 'import type' from webpack-dev-server under Node16 CJS module resolution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The webpack-dev-server 4→5 bump (needed for CG CVE fixes) introduced supports-color@10.2.2 into presence-tracker's transitive dep chain, which caused pnpm to create a new debug@4.4.3(supports-color@10.2.2) peer variant. types_jest-environment-puppeteer, which had no webpack-dev-server dep, kept resolving the older debug@4.4.3(supports-color@8.1.1) variant. That variant divergence cascaded up through jest-environment-puppeteer → puppeteer, producing two nominally-incompatible Page types: - The Page imported by presence-tracker's test resolved via the (supports-color@10.2.2) puppeteer variant. - The Page returned by the jest-environment-puppeteer 'page' global (typed via @types/jest-environment-puppeteer, which links to this workspace package) resolved via the (supports-color@8.1.1) variant. - Result: TS2345 mismatched Page in presenceTracker.test.ts. Add puppeteer, typescript, and webpack-dev-server as devDeps on the types workspace so its jest-environment-puppeteer resolution shares the same peer axis as presence-tracker's. Verified via lockfile diff that both importers now resolve jest-environment-puppeteer@10.1.4(debug@4.4.3(supports-color@10.2.2))(supports-color@10.2.2)(typescript@5.4.5) identically, and confirmed locally with presence-tracker test:jest, full ci:test:jest sweep, ci:build, and test:realsvc:local:report:full. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Root's puppeteer devDep and presence-tracker's puppeteer resolve to different pnpm peer variants (root:supports-color@8.1.1 vs presence-tracker:supports-color@10.2.2). The shim was declaring 'page: JestPuppeteerGlobal["page"]', which pulled Page transitively through jest-environment-puppeteer.d.ts's own 'import from "puppeteer"'. That import resolves at the .pnpm real path of jest-env-puppeteer, whose ancestor node_modules only contains root's (8.1.1) variant — a different real file from presence-tracker's (10.2.2) variant. TypeScript deduplicated by Package ID locally but not consistently on CI, producing TS2345 mismatched-Page errors in presenceTracker.test.ts. Importing Page directly from 'puppeteer' inside the shim resolves via types_jest-environment-puppeteer/node_modules/puppeteer (10.2.2), the identical real path as consumers, so type identity is unambiguous. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
kian-thompson
force-pushed
the
kian-thompson/cg-alerts-fix
branch
from
July 27, 2026 18:02
05c6a56 to
05c4773
Compare
jenn-le
approved these changes
Jul 27, 2026
Contributor
Bundle size comparisonBase commit: Notable changes
Per-bundle deltas
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Address ~50 Component Governance alerts flagged against the repo. Uses pnpm overrides (with exact pins for supply-chain-sensitive packages) for transitive deps, and direct version bumps for packages we own the specifier for.
Root
pnpm-workspace.yamloverridesaxios@<1:^0.32.0→^0.33.0(CVE-2026-44486/44487/44490/44492, GHSA-gcfj-64vw-6mp9)axios@^1.15.0:1.16.0→1.18.1(exact pin) — fixes GHSA-gcfj/jqh4/mmx7/7q8q/mwf2/f4gw/xj6q. Exact pin per the axios supply-chain compromise note in this file.brace-expansion: added>=1<2 → ^1.1.16,>=2<3 → ^2.1.2; bumped>=5<6to^5.0.7(CVE-2026-13149)js-yaml: added>=3<4 → ^3.15.0,>=4<5 → ^4.3.0(CVE-2026-59869)webpack: added>=5<6 → ^5.104.1(CVE-2025-68157, CVE-2025-68458)websocket-driver: added>=0<1 → ^0.7.5(CVE-2026-54466 Critical, CVE-2026-54490)fast-uri:^3.1.2→^4.1.1(CVE-2026-16221)Compat-workspaces overrides: matching axios/brace-expansion bumps.
Server workspaces (routerlicious/gitrest/historian): added
uuid@<7 → ^11.1.1to patch CVE-2026-41907.uuidis a dead transitive ofkafka-node@5.0.0(declared but never imported), so API compat is not a concern.Direct dependency bumps
webpack-dev-server:~4.15.2→~5.2.6across 41 example/tool packages (CVE-2025-30359/30360, CVE-2026-6402/9595/14620/14631). Repo already requires node ≥22 and webpack ≥5; no config uses the removed v4-only APIs (onBefore/AfterSetupMiddleware,http2,https: {}).morgan:^1.8.1→^1.11.0intinyliciousandservices-utils(CVE-2026-5078, log forging via:remote-user).Build fixes triggered by the bumps above
webpack-dev-server@5.d.ts referencesopen@10(ESM-only), which trips TS1479 under Node16 CJS resolution. EnabledskipLibCheckin the two consumer tsconfigs (examples/utils/example-webpack-integration,examples/utils/webpack-fluid-loader).supports-color@10.2.2intopresence-tracker's transitive chain, which created a secondpuppeteer@23.10.3pnpm peer variant. The existing@types/jest-environment-puppeteerworkspace shim resolved through the root's oldersupports-color@8.1.1variant, producing TS2345 mismatched-Pageerrors inpresenceTracker.test.ts. Fixed by:puppeteer,typescript, andwebpack-dev-serveras devDeps on the types shim so itsjest-environment-puppeteerresolution shares the same peer axis as consumers.Browser/BrowserContext/Pagedirectly from"puppeteer"inside the shim soPageresolves viatypes_jest-environment-puppeteer/node_modules/puppeteer— identical real path as consumers, unambiguous type identity even under CI's non-deterministic dedup.Cleanup: removed three dead
"browser": { "moniker": ... }aliases inwebpack-fluid-loader,local-driver, andmemory-orderer(no source importsmoniker; underlying@fluidframework/server-services-clientnow usessillyname).monikeris no longer present in any lockfile.All affected lockfiles regenerated (root,
compat-workspaces/full,server/routerlicious,server/gitrest,server/historian) and verified to contain nopackagefeedproxy/ms-feed-*tarball URLs (supply-chain policy).Intentionally deferred (not in this PR)
Reviewer Guidance
The review process is outlined on this wiki page.
webpack.config.cjsfiles for v4-only removed APIs and none appear. Please double-check any dev-server configs you're familiar with.axios@^1.15.0 → 1.18.1override is an exact pin to preserve the existing supply-chain discipline in this file; do not change to a caret without discussion.types_jest-environment-puppeteerdevDep additions look larger than necessary; they are load-bearing. Removingtypescriptcauses the shim'spuppeteerto resolve to a differenttypescriptpeer variant than consumers, reintroducing TS2345. Removingwebpack-dev-serverstill type-checks locally but reintroduces mixedsupports-color@8/10peer variants in the lockfile and matches the CI-flake conditions noted above.