chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive) #63

2026-10-25T23:50:27-04:00

jared commented

2026-10-25 23:50:27 -04:00

The npm advisory database flagged 19 packages in pnpm-lock.yaml, including 2 critical.

None of them ship to users. I checked the built embedded bundle that cinny serves: no DOMPurify, fflate, elliptic, zod, undici, js-yaml or qs, and the only PBKDF2 is a Web Crypto call. These packages run on developer machines and in CI.

Package	Was	Now	Issue
storybook, @storybook/*	10.6.0	10.6.3	Critical: dev server code injection from the local network
vitest, @vitest/*	4.1.11	4.1.12	Code injection via mock registration (`@vitest/ui` was pinned exactly, now `^4.1.12`)
tinypool (override)	2.1.0	2.1.2	Critical: prototype pollution leading to remote code execution
vite	8.2.2	8.3.5	Dev-server file exposure, launch-editor issues
brace-expansion, browserslist, smol-toml, source-map-js, postcss-selector-parser, baseline-browser-mapping, fflate, pbkdf2, zod 4		overrides	Denial of service and similar issues
qs, js-yaml, undici, dompurify		existing overrides raised	Fixed versions

Left: elliptic (no fixed release, low) and zod 3 (no 3.x fix; a dependency pins it). After this, 2 flagged packages remain, down from 19.

Tested: pnpm install --frozen-lockfile succeeds, vitest run src/lotus passes 144/144, and pnpm build:embedded succeeds.

No new release is needed: the bundle contents don't change.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

The npm advisory database flagged **19 packages** in `pnpm-lock.yaml`, including 2 critical. **None of them ship to users.** I checked the built embedded bundle that cinny serves: no DOMPurify, fflate, elliptic, zod, undici, js-yaml or qs, and the only PBKDF2 is a Web Crypto call. These packages run on developer machines and in CI. | Package | Was | Now | Issue | |---|---|---|---| | storybook, @storybook/* | 10.6.0 | **10.6.3** | **Critical:** dev server code injection from the local network | | vitest, @vitest/* | 4.1.11 | **4.1.12** | Code injection via mock registration (`@vitest/ui` was pinned exactly, now `^4.1.12`) | | tinypool (override) | 2.1.0 | **2.1.2** | **Critical:** prototype pollution leading to remote code execution | | vite | 8.2.2 | **8.3.5** | Dev-server file exposure, launch-editor issues | | brace-expansion, browserslist, smol-toml, source-map-js, postcss-selector-parser, baseline-browser-mapping, fflate, pbkdf2, zod 4 | | overrides | Denial of service and similar issues | | qs, js-yaml, undici, dompurify | | existing overrides raised | Fixed versions | **Left:** `elliptic` (no fixed release, low) and `zod` 3 (no 3.x fix; a dependency pins it). After this, 2 flagged packages remain, down from 19. **Tested:** `pnpm install --frozen-lockfile` succeeds, `vitest run src/lotus` passes 144/144, and `pnpm build:embedded` succeeds. **No new release is needed:** the bundle contents don't change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-25 23:50:28 -04:00

chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive)

CI / Build embedded bundle (push) Skipped

CI / Build embedded bundle (pull_request) Successful in 4m6s

Details

CI / Publish to Gitea npm registry (pull_request) Skipped

Details

43cbd8409d

The npm advisory database flagged 19 packages in pnpm-lock.yaml. None of them
ship in the embedded call bundle (checked against the built dist); they run
on developer machines and in CI:
- storybook / @storybook/* 10.6.0 -> 10.6.3: critical, dev server code
  injection from the local network.
- vitest 4.1.12 (+ @vitest/ui unpinned to ^4.1.12), tinypool ^2.1.2:
  mock registration code injection, prototype-pollution RCE.
- vite ^8.3.5: dev-server file exposure, launch-editor issues.
- Overrides for transitive tooling: brace-expansion, browserslist,
  smol-toml, source-map-js, postcss-selector-parser, baseline-browser-
  mapping, fflate, pbkdf2, zod 4; existing qs/js-yaml/undici/dompurify
  overrides raised to the fixed versions.

Left: elliptic (no fixed release, low), zod 3 (no 3.x fix; a dependency
pins it). Lotus unit tests 144/144, build:embedded OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared scheduled this pull request to auto merge when all checks succeed 2026-10-25 23:50:34 -04:00

jared merged commit 117467b1fb into lotus

2026-10-25 23:59:03 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/element-call#63