Repository navigation
build(frontend): update vue, source-map-js and xlsx for the open audit findings - #251
Merged
Merged
Conversation
…t findings The required frontend-security check fails on main for two advisories published this week, and from 2026-10-07 for two more whose exceptions expire: - @vue/server-renderer GHSA-g2v6-rqmx-r4w6: vue 3.5.26 -> 3.5.43, through an override in the same form as the postcss one; - source-map-js GHSA-68fv-2mgg-jv7q: 1.2.1 -> 1.2.2, through an override; - xlsx GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9: npm has no fixed release, so xlsx now comes from the author's own distribution, https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz, and the two exceptions are deleted. The site only writes spreadsheets (usage export); the owner chose the fixed build over renewing the exceptions. The lockfile changes only what these three pull in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
frontend-securityis a required check and fails on main for every PR:@vue/server-rendererGHSA-g2v6-rqmx-r4w6 andsource-map-jsGHSA-68fv-2mgg-jv7q;xlsxexceptions (GHSA-4r6h-8v6p-xvw6, GHSA-5pgg-2g8v-p4x9) expire on 2026-10-06.Change
vue3.5.26 → 3.5.43 andsource-map-js1.2.1 → 1.2.2, each through apnpm.overridesentry in the form the file already uses forpostcssandnanoid. Thevuerange independenciesis unchanged.xlsx0.18.5 → 0.20.3. npm has no fixed release; the fixed build is published by the author athttps://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz, and the dependency now points there. The two exceptions are deleted. The owner chose this over renewing the exceptions.xlsxis used in one place, the admin usage export, which writes a sheet and never reads one.Build note
pnpm installnow fetches one tarball fromcdn.sheetjs.comin addition to the registry. The lockfile records the URL and version; pnpm does not record an integrity hash for a remote tarball.Verification
pnpm audit --prod --audit-level=highreports no high or critical finding;tools/check_pnpm_audit_exceptions.pypasses with the two exceptions removed.pnpm install --frozen-lockfilefrom the committed lockfile;vue-tsc --noEmit;check:i18n;vite build.groupModelAllowlist.spec.ts"accepts wildcards at any position" (not in CI's spec list, unrelated to these packages).🤖 Generated with Claude Code