Repository navigation
JavaScript Oracle KMS Storage: security dependency updates (KSM-1221) - #1167
Conversation
- minimatch -> 9.0.9 (CVE-2026-27903, CVE-2026-27904, CVE-2026-26996 ReDoS) - handlebars -> 4.7.9 (CVE-2026-33938, CVE-2026-33941) - dev-only via ts-jest Also picks up an adjacent minimatch brace-expansion ReDoS fix (VM-2511) from the same lockfile regeneration. Lockfile-only, no package.json range changes. Cherry-picked and scoped to sdk/javascript/packages/oracle/package-lock.json from efde007d, ca69e44b, and b9aef2fa (Sergey Aldoukhov). KSM-1221
Arbitrary file read via a sourceMappingURL comment, fixed in 7.29.6. Build-time only: @babel/core is a transitive devDependency via ts-jest, never shipped. The batch bump that fixed this same CVE in the aws/azure/core/gcp lockfiles (831b7b48, Sergey Aldoukhov) didn't touch oracle - this package was missed in that pass. Applied here via `npm update @babel/core --package-lock-only` to pick up the correct transitive version set rather than hand-editing the version string. KSM-1221
…tch, brace-expansion, picomatch and related transitive advisories
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
dafc050 to
6bc8c0a
Compare
mgallego-keeper
left a comment
mgallego-keeper
left a comment
There was a problem hiding this comment.
Security review.
This review checked the dependency bump for supply-chain integrity and CVE-fix completeness, and compared this package's fix against its sibling packages in the same batch.
What I verified:
npm auditon the pre-change lockfile found 15 vulnerabilities. The post-change lockfile has 0. I ran both audits myself.- I checked whether this package was missing a fix its sibling packages received. It was not.
browserslist,baseline-browser-mapping,@humanfs/node, andflattedare all fixed, as a side effect of thenpm audit fixcommit. - Every changed lockfile entry resolves to
https://registry.npmjs.org/with a matching integrity hash. I checked this exhaustively, not by sample. minimatchclears its patched threshold at all 6 nested locations.package.jsonis unchanged.npm cisucceeds cleanly on the final lockfile.
Requested change:
Clearing an advisory on a pinned uuid version inside oci-common required bumping oci-common and oci-keymanagement from 2.127.0 to 2.140.1. That is 19 published releases apart. Neither package name appears in any commit message, in the CHANGELOG entry, or in the PR description.
oci-common and oci-keymanagement are the actual Oracle Key Management SDK this package wraps. I confirmed the new version is genuinely published by Oracle. I also checked Oracle's own SDK changelog for this range and found no breaking changes to the Key Management or Common modules.
The version jump itself looks safe. Please add one line to the commit message or the CHANGELOG naming oci-common and oci-keymanagement, with the old and new versions, before merge. A production KMS SDK version change should never ride along as a silent side effect of a generic audit fix.
…angelog (KSM-1221) Review feedback: the npm audit fix cascade bumped oci-common and oci-keymanagement 2.127.0 -> 2.140.1 (19 releases) to clear a nested uuid advisory, but neither package was named in the commit message, CHANGELOG, or PR description.
423dd53 to
585a72f
Compare
mgallego-keeper
left a comment
mgallego-keeper
left a comment
There was a problem hiding this comment.
Security re-review, round 2.
Confirmed: the new commit (585a72f) adds exactly the CHANGELOG line I asked for. It names oci-common and oci-keymanagement. It gives both versions, 2.127.0 to 2.140.1. It gives the reason: a nested uuid advisory.
I diffed this commit against the one I reviewed before. Only the CHANGELOG changed. The lockfile did not change. My previous lockfile audit still holds.
I also re-verified the security claims myself this round, not just by reading:
- Ran
npm audit --package-lock-onlyon the actual PR lockfile myself. Result: 0 vulnerabilities. - Checked all 503 resolved lockfile entries by hand. Every one resolves from
https://registry.npmjs.org/with a matching integrity hash. None uses another registry. - oci-common and oci-keymanagement both land on the real 2.140.1 package. This matches the Socket bot scan on this PR.
- The CI workflow for this package runs
npm ciandnpm testagainst the actual latest commit. It passed.
Requested change fully addressed. Approving.
Two notes, both outside this PR's diff. Neither blocks this PR.
-
The PR description still says "Draft, not ready to merge." But this PR is no longer marked as a draft. Please update the description so the two do not contradict each other.
-
While reviewing this package's
OracleKeyValueStore.ts, I found that it, and the sibling AWS, Azure, and GCP storage backends, write the config file withfs.writeFilecalls. None of these calls sets a restrictive file mode. On a standard umask, this leaves the file world readable. This includes the fully decrypted plaintext in thedecryptConfig(true)path. This defect is unrelated to this PR and predates it. Filed as KSM-1444, linked to the existing KSM-1367 epic covering the same four files.
d244048
into
release/storage/javascript/oracle-kms/v1.0.1
3 participants
Summary
JavaScript Oracle KMS Storage: updates js-yaml, handlebars, minimatch, brace-expansion, picomatch, and other transitive dependencies to resolve every open Dependabot advisory on this package's
package-lock.json.Changes
Maintenance
npm audit fix.package.jsonunchanged; every affected package resolves within its existing declared range.Testing
Breaking Changes
None.
Related Issues
Draft, not ready to merge. This branch needs
@keeper-security/secrets-manager-corebumped to v17.6.0 once that release publishes. Its range (^17.3.0) already allows 17.6.0; it's just not out yet. Opening as a draft now so review on the dependency fixes isn't blocked on that.