Update npm dependencies with known vulnerabilities - #27414
Open
dennisoelkers wants to merge 6 commits into
Open
dennisoelkers wants to merge 6 commits into
dennisoelkers wants to merge 6 commits into
Conversation
`yarn audit` in `graylog2-web-interface` reported 458 findings (4 critical, 274 high, 133 moderate, 47 low). This brings it down to 4 moderate, none of which have a patched version available on the current major (see below). Most of this is a `yarn.lock` refresh: the stale lockfile entries for the affected transitive packages were dropped and re-resolved within the semver ranges their parents already declare, so almost no manifest changes were needed. ## Manifest changes | Package | From | To | Why | | --- | --- | --- | --- | | `puppeteer` (dev) | `^24.19.0` | `^25.11.0` | `@puppeteer/browsers` 25.x replaced `extract-zip` with `modern-tar`, clearing two high-severity symlink path-traversal advisories (CVE-2026-19693, CVE-2026-56876) that have no fix in `extract-zip` itself. Only `checkProductionBuild.js` uses puppeteer, and only via `launch`/`newPage`/`goto`, which are unchanged in 25.x. | | `react-router-dom` (graylog-web-plugin) | `6.30.3` | `6.30.6` | Open redirect via backslash in `<Link>`/`useNavigate` (CVE-2025-68470). Also pulls `@remix-run/router` 1.23.4. | | `maplibre-gl` (resolution) | `4.7.1` | `^6.4.1` | XSS sanitizer bypass in `DOM.sanitize()` (CVE-2026-85061, critical). No plotly.js release — up to and including 4.1.1 — has moved off `maplibre-gl@^4.7.1`, so a resolution is the only route to a patched version. See the caveat below. | ## Lockfile-only bumps | Package | From | To | Why | | --- | --- | --- | --- | | `tar` | 7.5.13 | 7.5.22 | Decompression/parse DoS via unlimited input (critical) | | `form-data` | 4.0.1 | 4.0.6 | Unsafe random function for choosing the boundary (critical) | | `minimatch` | 3.1.2, 9.0.5 | 3.1.5, 9.0.9 | Several ReDoS advisories (repeated wildcards, GLOBSTAR backtracking, nested extglobs) | | `brace-expansion` | 1.1.11, 2.0.1, 5.0.2 | 1.1.21, 2.1.7, 5.0.12 | ReDoS | | `picomatch` | 2.3.1, 4.0.2, 4.0.3 | 2.3.2, 4.0.7 | ReDoS | | `js-yaml` | 3.14.2, 4.2.0 | 3.15.2, 4.3.2 | Prototype pollution / parser DoS | | `ajv` | 6.12.6, 8.8.1, 8.12.0 | 6.15.0, 8.20.0 | Prototype pollution | | `glob` | 10.4.5 | 10.5.0 | ReDoS | | `socks` | 2.8.4 | 2.8.10 | Pulls `ip-address` 9.0.5 -> 10.7.2, which is where the high-severity parsing fix lives | | `less` | 4.5.1 | 4.9.1 | 4.9 dropped its `image-size` dependency entirely, clearing two high-severity infinite-loop advisories that have no fix in `image-size` | | `immutable` | 3.8.2 | 3.8.4 | Prototype pollution | | `qs` | 6.15.2 | 6.16.0 | Prototype pollution | | `path-to-regexp` | 8.3.0 | 8.4.2 | ReDoS | | `nanoid` | 3.3.17 | 3.3.19 | Predictable ID generation | | `json5` | 2.2.1 | 2.2.3 | Prototype pollution | | `@babel/core` | 7.26.0, 7.28.4, 7.28.5 | 7.29.7 | RegExp complexity in generated code | | `@babel/runtime-corejs2` | 7.13.10 | 7.29.7 | RegExp complexity in generated code | | `body-parser` | 2.2.2 | 2.3.0 | DoS on malformed input | | `postcss-selector-parser` | 6.0.2, 6.0.4, 7.1.0 | 6.1.4, 7.1.6 | ReDoS | | `diff` | 4.0.2 | 4.0.4 | ReDoS | ## Caveat on the maplibre-gl resolution `src/views/custom-plotly.ts` builds from `plotly.js/lib/core` and registers only bar, pie, scatter, heatmap, sankey and scatterpolar, so the maplibre-backed map traces are never imported and maplibre-gl was never in the bundle. That makes the override safe today, but it does pin a transitive dependency two majors ahead of what plotly.js declares — registering a map trace later would need this revisited. ## Remaining advisories (no fix available) - `react-router` x2 (moderate, CVE-2026-53666 / CVE-2026-53669): 6.30.6 is the last 6.x release and both are only patched in 7.18.0. Fixing these means a react-router v7 migration across the app. - `bootstrap` 3.4.1 x2 (moderate, CVE-2024-6485 / CVE-2025-1647): no patch exists, Bootstrap 3 is EOL. Fixing these means a Bootstrap 5 migration. Verified with `yarn tsgo` (clean, no source changes needed) and `yarn test` (776 suites, 4151 passed, 2 skipped, 0 failures). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…le-npm-dependencies # Conflicts: # graylog2-web-interface/yarn.lock
`yarn check-production-build` failed on this branch with
`TypeError: n is not a function`, thrown while the app chunk was still
evaluating module factories. Source-mapping the minified frames gives this
require chain:
qs/lib/stringify.js
-> side-channel
-> side-channel-map
-> get-intrinsic/index.js:32 var $gOPD = require('gopd');
-> gopd/index.js:5 GetIntrinsic('%Object.getOwnPropertyDescriptor%', true)
`GetIntrinsic` is `{}` at that point, because `gopd` is being required from
inside `get-intrinsic`'s own factory, so `require('get-intrinsic')` hands
back its still-empty `module.exports`.
## Root cause
`webpack/core.js` sets `resolve.modules` to absolute paths (the app dir plus
the single top-level `node_modules`). That disables node's walk-up
resolution, so nested `node_modules` copies are invisible to the bundle and
every specifier resolves to whatever yarn hoisted to the root — regardless
of the range the requiring package declared.
Refreshing the lockfile moved the hoisted `get-intrinsic` from 1.2.4 to
1.3.0. 1.2.4 depends on neither `gopd` nor `es-define-property`; 1.3.0
depends on both, specifically on `gopd@^1.2.0` and `es-define-property@^1.0.1`,
the versions where those packages dropped their own dependency on
`get-intrinsic` in order to break exactly this cycle. Node would have
honoured that — `node_modules/get-intrinsic/node_modules/gopd` is correctly
nested at 1.2.0 — but webpack cannot see it and used the root copies,
`gopd@1.0.1` and `es-define-property@1.0.0`, both of which require
`get-intrinsic` back.
## Fix
Pin both packages to the cycle-free versions repo-wide:
| Resolution | Version | Why |
| --- | --- | --- |
| `gopd` | `^1.2.0` | 1.2.0 dropped its `get-intrinsic` dependency (it now reads `Object.getOwnPropertyDescriptor` directly) and has no dependencies at all |
| `es-define-property` | `^1.0.1` | 1.0.1 dropped its `get-intrinsic` dependency for the same reason and likewise has no dependencies |
Every range declared anywhere in the tree (`^1.0.1`/`^1.2.0` for `gopd`,
`^1.0.0`/`^1.0.1` for `es-define-property`) is satisfied by these, so this
only collapses two duplicate lockfile entries each.
Both cycles were fixed one at a time and confirmed by rebuilding in between:
pinning `gopd` alone moved the throw from `gopd/index.js:5` to
`es-define-property/index.js:6`, reached from the very next line of
`get-intrinsic/index.js`. Pinning both clears it.
Note that master is one hoisting decision away from the same crash — the
underlying fragility is the flattened `resolve.modules` config, which
silently discards the nesting that npm/yarn use to keep incompatible
versions apart. Worth addressing separately.
`webpack/vendor-module-ids.json` is webpack's `recordsPath` and is
regenerated by the build; it changes here because `@babel/runtime-corejs2`
went from 7.13.10 to 7.29.7 in the dependency update.
Verified: `yarn check-production-build` now reports
"Success: Encountered 0 errors and 0 messages on the console during loading."
`yarn tsgo` clean, `yarn test` 777 suites / 4169 passed / 0 failures,
`yarn audit` unchanged at 4 moderate.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dennisoelkers
marked this pull request as ready for review
September 17, 2026 12:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation and Context
yarn auditingraylog2-web-interfacereported 458 findings (4 critical, 274 high, 133 moderate, 47 low). This brings it down to 4 moderate, none of which have a patched version available on the current major (see below).Most of this is a
yarn.lockrefresh: the stale lockfile entries for the affected transitive packages were dropped and re-resolved within the semver ranges their parents already declare, so almost no manifest changes were needed./nocl No user-facing change.
Manifest changes
puppeteer(dev)^24.19.0^25.11.0@puppeteer/browsers25.x replacedextract-zipwithmodern-tar, clearing two high-severity symlink path-traversal advisories (CVE-2026-19693, CVE-2026-56876) that have no fix inextract-zipitself. OnlycheckProductionBuild.jsuses puppeteer, and only vialaunch/newPage/goto, which are unchanged in 25.x.react-router-dom(graylog-web-plugin)6.30.36.30.6<Link>/useNavigate(CVE-2025-68470). Also pulls@remix-run/router1.23.4.maplibre-gl(resolution)4.7.1^6.4.1DOM.sanitize()(CVE-2026-85061, critical). No plotly.js release — up to and including 4.1.1 — has moved offmaplibre-gl@^4.7.1, so a resolution is the only route to a patched version. See the caveat below.Lockfile-only bumps
tarform-dataminimatchbrace-expansionpicomatchjs-yamlajvglobsocksip-address9.0.5 -> 10.7.2, which is where the high-severity parsing fix liveslessimage-sizedependency entirely, clearing two high-severity infinite-loop advisories that have no fix inimage-sizeimmutableqspath-to-regexpnanoidjson5@babel/core@babel/runtime-corejs2body-parserpostcss-selector-parserdiffCaveat on the maplibre-gl resolution
src/views/custom-plotly.tsbuilds fromplotly.js/lib/coreand registers only bar, pie, scatter, heatmap, sankey and scatterpolar, so the maplibre-backed map traces are never imported and maplibre-gl was never in the bundle. That makes the override safe today, but it does pin a transitive dependency two majors ahead of what plotly.js declares — registering a map trace later would need this revisited.Remaining advisories (no fix available)
react-routerx2 (moderate, CVE-2026-53666 / CVE-2026-53669): 6.30.6 is the last 6.x release and both are only patched in 7.18.0. Fixing these means a react-router v7 migration across the app.bootstrap3.4.1 x2 (moderate, CVE-2024-6485 / CVE-2025-1647): no patch exists, Bootstrap 3 is EOL. Fixing these means a Bootstrap 5 migration.Verified with
yarn tsgo(clean, no source changes needed) andyarn test(776 suites, 4151 passed, 2 skipped, 0 failures).How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist: