pkg(security): Bump transitive dependency security vulns by ntucker · Pull Request #4058 · reactive/data-client

ntucker · 2026-07-25T17:33:08Z

Summary

This PR contains the following updates:

Package	Change	Location
tar	`6.2.1` / `7.5.10` → `7.5.22`	root (`yarn.lock`)
serialize-javascript	`6.0.2` → `7.0.7`	root + examples
dompurify	`3.4.8` → `3.4.12`	root (`yarn.lock`)
immutable	`4.3.8` → `4.3.9`, `5.1.5` → `5.1.9`	root + examples
svgo	`4.0.1` → `4.0.2` (`3.3.3` → `3.3.4`)	root + examples
sigstore	`1.9.0` / `4.0.0` → `5.0.0`	root (`yarn.lock`)
socks	→ `2.8.9`	root (`yarn.lock`)
ip-address	`9.0.5` → `10.2.0`	root (via socks)
uuid	`8.3.2` → `≥11.1.1`	root + examples
minimatch	`5.1.6`/`8.0.4`/`9.0.1` → `5.1.9`/`8.0.7`/`9.0.9`	root (`yarn.lock`)
glob	`11.0.3` → `11.1.0`	root (`yarn.lock`)
yaml	`2.8.2` → `2.9.0`	root (`yarn.lock`)
brace-expansion	`2.0.1`/`5.0.5` → `2.1.2`/`5.0.8`	root + examples
ws	`8.19.0`/`8.20.1` → `8.21.1`	root + examples
shell-quote	`1.8.4` → `1.10.0`	examples
postcss	`8.4.31`/`8.5.15` → `8.5.23`	examples
body-parser	`1.20.5` → `1.20.6`	examples
websocket-driver	`0.7.4` → `0.7.5`	examples
fast-uri	`3.1.2` → `3.1.4`	examples/todo-app
sharp	`0.34.5` → `0.35.3`	examples/nextjs
next	`~15.5.18` → `~15.5.21`	examples/nextjs

Also adds yarn resolutions / npm overrides so transitive deps stay on patched ranges.

tar

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

CVE-2026-26960 / GHSA-83g3-92jg-28cx — high

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

CVE-2026-24842 / GHSA-34x7-hfp2-rc4v — high

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

CVE-2026-23745 / GHSA-8qq5-rm4j-mr97 — high

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

CVE-2026-23950 / GHSA-r6q2-hw4h-h46w — high

tar has Hardlink Path Traversal via Drive-Relative Linkpath

CVE-2026-29786 / GHSA-qffp-2rhf-9h96 — high

node-tar applies PAX size override to intermediary GNU long-name/long-link headers (file smuggling)

CVE-2026-53655 / GHSA-vmf3-w455-68vh — medium

node-tar: Process crash via PAX numeric path type confusion

CVE-2026-59871 / GHSA-w8wr-v893-vjvp — medium

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

CVE-2026-59875 / GHSA-gvwx-54wh-qm9j — medium

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS

GHSA-r292-9mhp-454m — medium

serialize-javascript

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

GHSA-5c6j-r48x-rmvq — high

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

CVE-2026-34043 / GHSA-qj8w-gfj5-8c6v — medium

dompurify

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard

CVE-2026-65898 / GHSA-cmwh-pvxp-8882 — medium

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements

GHSA-c2j3-45gr-mqc4 — low

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

CVE-2026-65899 / GHSA-vxr8-fq34-vvx9 — low

immutable

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

CVE-2026-59879 / GHSA-v56q-mh7h-f735 — high

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

CVE-2026-59880 / GHSA-xvcm-6775-5m9r — high

svgo

SVGO removeScripts plugin leaves some executable scripts intact

GHSA-2p49-hgcm-8545 — high

sigstore

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

CVE-2026-48815 / GHSA-52v5-jr5w-gjxr — high

ip-address (via socks)

ip-address has XSS in Address6 HTML-emitting methods

CVE-2026-42338 / GHSA-v2v4-37r5-5v8g — medium

uuid

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq — medium

minimatch / glob / brace-expansion

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

CVE-2026-26996 / GHSA-3ppc-4f35-3m26 — high

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

CVE-2026-27903 / GHSA-7r86-cg39-jmmj — high

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

CVE-2026-27904 / GHSA-23c5-xmqv-rm74 — high

glob CLI: Command injection via -c/--cmd executes matches with shell:true

CVE-2025-64756 / GHSA-5j98-mcp5-4vw2 — high

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp — high

brace-expansion: Large numeric range defeats documented `max` DoS protection

CVE-2026-45149 / GHSA-jxxr-4gwj-5jf2 — medium

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

CVE-2026-33750 / GHSA-f886-m6hf-6m8v — medium

yaml

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

CVE-2026-33532 / GHSA-48c2-rrv3-qjmp — medium

ws

ws: Memory exhaustion DoS from tiny fragments and data chunks

CVE-2026-48779 / GHSA-96hv-2xvq-fx4p — high

ws: Uninitialized memory disclosure

CVE-2026-45736 / GHSA-58qx-3vcg-4xpx — medium

shell-quote

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

CVE-2026-13311 / GHSA-395f-4hp3-45gv — high

postcss

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

CVE-2026-45623 / GHSA-6g55-p6wh-862q — high

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

GHSA-r28c-9q8g-f849 — high

PostCSS has XSS via Unescaped `</style>` in its CSS Stringify Output

CVE-2026-41305 / GHSA-qx2v-qp2m-jg93 — medium

body-parser

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

CVE-2026-12590 / GHSA-v422-hmwv-36x6 — low

websocket-driver

websocket-driver: Message corruption via abuse of protocol length headers

CVE-2026-54466 / GHSA-xv26-6w52-cph6 — critical

websocket-driver: Resource limit bypass via message compression

CVE-2026-54490 / GHSA-mp7j-qc5w-4988 — medium

fast-uri

fast-uri vulnerable to host confusion via literal backslash authority delimiter

CVE-2026-16221 / GHSA-v2hh-gcrm-f6hx — high

fast-uri vulnerable to host confusion via failed IDN canonicalization

CVE-2026-13676 / GHSA-4c8g-83qw-93j6 — high

sharp

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

GHSA-f88m-g3jw-g9cj — high

Remaining (no upstream patch / mis-ranged advisory)

Package	Notes
`brace-expansion@1.1.16`	Still flagged by GHSA-mh99-v99m-4gvg (`<=5.0.7`); no fixed 1.x release
`elliptic@6.6.1`	GHSA-848j-6mx2-7j84 — no patched release

Test plan

CI green (lint / typecheck / unit tests)
yarn npm audit --all --recursive --no-deprecations only reports brace-expansion / elliptic leftovers
Example prod audits clean: npm audit --omit=dev in github-app, todo-app, vue-todo-app
Close obsolete Dependabot PRs for these example bumps after merge

Made with Cursor

Force patched versions via yarn resolutions and example npm overrides, and refresh lockfiles across root and standalone examples. Co-authored-by: Cursor <cursoragent@cursor.com>

vercel · 2026-07-25T17:33:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs-site	Ignored	Preview	Jul 25, 2026 5:33pm

changeset-bot · 2026-07-25T17:33:13Z

⚠️ No Changeset found

Latest commit: 6227ccb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-07-25T17:35:13Z

Size Change: 0 B

Total Size: 81.2 kB

ℹ️ View Unchanged

Filename	Size
`examples/test-bundlesize/dist/App.js`	1.46 kB
`examples/test-bundlesize/dist/polyfill.js`	307 B
`examples/test-bundlesize/dist/rdcClient.js`	10.9 kB
`examples/test-bundlesize/dist/rdcEndpoint.js`	8.07 kB
`examples/test-bundlesize/dist/react.js`	59.7 kB
`examples/test-bundlesize/dist/webpack-runtime.js`	784 B

_{compressed-size-action}

codecov · 2026-07-25T17:37:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.84%. Comparing base (8756212) to head (6227ccb).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4058   +/-   ##
=======================================
  Coverage   97.84%   97.84%           
=======================================
  Files         156      156           
  Lines        3057     3057           
  Branches      612      612           
=======================================
  Hits         2991     2991           
  Misses         18       18           
  Partials       48       48

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

pkg(security): Bump transitive dependency security vulns

6227ccb

Force patched versions via yarn resolutions and example npm overrides, and refresh lockfiles across root and standalone examples. Co-authored-by: Cursor <cursoragent@cursor.com>

ntucker merged commit e823560 into master Jul 25, 2026
23 checks passed

ntucker deleted the pkg/security-bump-transitive-deps branch July 25, 2026 17:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

pkg(security): Bump transitive dependency security vulns - #4058

pkg(security): Bump transitive dependency security vulns#4058
ntucker merged 1 commit into
masterfrom
pkg/security-bump-transitive-deps

ntucker commented Jul 25, 2026

Uh oh!

vercel Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 25, 2026

Uh oh!

github-actions Bot commented Jul 25, 2026

Uh oh!

codecov Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

ntucker commented Jul 25, 2026

Summary

tar

node-tar: Decompression/parse DoS via unlimited input

node-tar: Negative tar entry size causes infinite loop in archive replace

node-tar Symlink Path Traversal via Drive-Relative Linkpath

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

tar has Hardlink Path Traversal via Drive-Relative Linkpath

node-tar applies PAX size override to intermediary GNU long-name/long-link headers (file smuggling)

node-tar: Process crash via PAX numeric path type confusion

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS

serialize-javascript

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

dompurify

DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard

DOMPurify: CUSTOM_ELEMENT_HANDLING bypasses afterSanitizeElements for allowed custom elements

DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output

immutable

Immutable.js List 32-bit trie overflow → unrecoverable DoS

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

svgo

SVGO removeScripts plugin leaves some executable scripts intact

sigstore

sigstore's certificateOIDs verification constraints are silently dropped and never enforced

ip-address (via socks)

ip-address has XSS in Address6 HTML-emitting methods

uuid

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

minimatch / glob / brace-expansion

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

glob CLI: Command injection via -c/--cmd executes matches with shell:true

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

brace-expansion: Large numeric range defeats documented max DoS protection

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

yaml

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

ws

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

shell-quote

shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407)

postcss

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

body-parser

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

websocket-driver

websocket-driver: Message corruption via abuse of protocol length headers

websocket-driver: Resource limit bypass via message compression

fast-uri

fast-uri vulnerable to host confusion via literal backslash authority delimiter

fast-uri vulnerable to host confusion via failed IDN canonicalization

sharp

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

next

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Next.js: Denial of Service in App Router using Server Actions

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js: Unbounded Server Action payload in Edge runtime

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Next.js: Denial of Service in the Image Optimization API using SVGs

Remaining (no upstream patch / mis-ranged advisory)

Test plan

Uh oh!

vercel Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

brace-expansion: Large numeric range defeats documented `max` DoS protection

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

PostCSS has XSS via Unescaped `</style>` in its CSS Stringify Output

vercel Bot commented Jul 25, 2026 •

edited

Loading

codecov Bot commented Jul 25, 2026 •

edited

Loading