fix(deps): bump sails-postgresql, sails-hook-sockets and lodash to clear CVEs

[itsalaidbacklife]

Summary

Replaces #1367 (minimist / CVE-2021-44906) and #1368 (lodash / CVE-2019-10744) by bumping the top-level dependencies that pull the vulnerable packages in, instead of adding overrides entries.

Three version bumps in package.json; package-lock.json regenerated with npm install. Net effect: 100 packages removed from the tree, vulnerable minimist gone entirely, plain-lodash copies down from 6 to 3.

Why not #1367 / #1368

Both PRs added a root overrides entry rather than moving the dependency that owns the old package.

#1367 — only one of six minimist consumers was vulnerable (knex@0.12.7 → minimist@1.1.3); the other five were already on 1.2.8. "overrides": { "minimist": "1.2.6" } upgraded one and downgraded five, including cypress, which explicitly declares ^1.2.8. Its lockfile also wasn't npm-generated — it deleted the hoisted minimist@1.2.8 and added five nested 1.2.6 duplicates, where an exact pin would hoist a single copy.

#1368 — despite the title, it never touched lodash; it overrode machinepack-urls to 6.0.1, moving that package's nested lodash 2.4.2 → 3.10.1. CVE-2019-10744 covers <4.17.12, so 3.10.1 is still vulnerable. Worse, _.defaultsDeep — the CVE's actual sink — does not exist in lodash 2.4.2 (added in 3.10.0), so the change introduced the vulnerable function, and moved the copy into an advisory range it had been below (Prototype Pollution in lodash, >=3.7.0 <4.17.19).

Changes

sails-postgresql 4.0.0 → 5.0.1

Resolves machinepack-postgresql@4.0.2 → waterline-sql-builder@3.0.1 → knex@2.4.2. knex 2.4.2 has no minimist dependency at all (it uses getopts), so the vulnerable copy leaves the tree rather than being pinned around.

advisory	before	after
minimist critical (prototype pollution, <1.2.6)	1.1.3	removed from tree
knex critical (SQLi <0.19.5; limited SQLi <2.4.0)	0.12.7	2.4.2
waterline-sql-builder critical (≤2.0.0)	2.0.0	3.0.1
machinepack-postgresql critical (≤4.0.1)	3.0.0	4.0.2
pg high (4.0.0-beta2 - 8.3.3)	8.3.0	8.11.0
debug high (ReDoS <2.6.9)	2.2.0	2.6.9 / 4.3.4
sails-postgresql high (via async)	4.0.0	5.0.1

Also drops the babel-runtime → core-js@2.6.12 install-script chain that only knex 0.12.7 pulled in.

The semVerMajor flag overstates the adapter risk: releases 5.0.0 and 5.0.1 each touch only package.json and .travis.yml — zero adapter source changes across 4.0.0 → 5.0.1. The substantive change is waterline-sql-builder 2.0.0 → 3.0.1, i.e. knex 0.12.7 → 2.4.2, so generated SQL is what needs exercising.

sails-hook-sockets 1.5.5 → 2.0.4

machinepack-urls@3.1.1 (the source of #1368's lodash 2.4.2) came from here. 2.0.0's release notes are explicit: "Upgraded machinepack-urls to resolve vulnerability/deprecation warnings." 2.0.4 pulls machinepack-urls@6.0.2-0, which drops plain lodash for @sailshq/lodash.

advisory	before	after
lodash 2.4.2 copy (4 matching advisories)	2.4.2	removed from tree
async high (prototype pollution)	2.0.1	2.6.4
semver high (ReDoS <5.7.2)	4.3.6	7.5.2
machinepack-redis high (≤2.0.6)	1.x	2.0.7
redis high (monitor-mode regex)	2.x	3.1.1+
socket.io (CORS <2.4.0; unhandled error <2.5.0)	2.0.3	2.5.0
engine.io (→ dropped from high to low)	3.1.x	3.6.2
machine / rttc / include-all / switchback / machinepack-urls	old	cleared

Deliberately 2.0.4, not 3.0.2. npm audit recommends 3.0.2 because it defaults to latest, but 3.x moves socket.io 2.5.0 → 4.8.1 — a breaking wire-protocol change (EIO 3 → EIO 4, with EIO3 compat off by default). Our client is src/plugins/sails.js:14, sails(socketIoClient) over sails.io.js@1.2.1 + socket.io-client@2.3.0, and upstream validates neither: sails.io.js has had no commit since April 2018 and pins socket.io-client: 2.0.3 in devDeps, and sails-hook-sockets@3.0.2 also still pins socket.io-client: 2.0.3 despite shipping socket.io 4. That migration is a separate spike. 2.0.4 keeps socket.io on 2.x, wire-compatible with our pinned client.

lodash 4.17.21 → 4.18.1

Our direct pin was behind. Clears the three advisories still matching 4.17.21:

• _.template code injection via imports key names — high, >=4.0.0 <=4.17.23
• _.unset/_.omit prototype pollution via array path bypass — moderate, <=4.17.23
• _.unset/_.omit prototype pollution — moderate, >=4.0.0 <=4.17.22

The _.omit ones are directly relevant: api/helpers/game-states/ai/get-legal-moves.js:28 calls _.omit(MoveType, disallowedMoveTypes) via the config/globals.js:20 global.

Since lodash resumed publishing after a five-year gap, provenance was checked: 4.17.23 (2026-01-21), 4.18.0 (2026-03-31), 4.18.1 (2026-04-01), all published by jdalton, maintainers jdalton/mathias/bnjmnt4n, repo github.com/lodash/lodash, registry signature present.

Verification

• npm install — clean; 16 added, 100 removed, 51 changed
• npm ls minimist — knex subtree gone; lowest version now 1.2.6 (sails' own exact pin)
• npm ls lodash — root at 4.18.1; the 2.4.2 copy gone
• npm audit — minimist, knex, waterline-sql-builder, machinepack-postgresql, pg, machinepack-urls, include-all, switchback, machinepack-redis, redis, sails-postgresql all cleared; engine.io and sails-hook-sockets dropped high → low
• npm run lint — clean
• npm run test:unit:client — 3/3 passing
• npm run test:unit:sails — not run locally (port 1337 was occupied on my machine; tests/unit/util/server.util.js:10 hardcodes it). Needs CI to confirm the 83 sails tests.
• Not yet exercised against real Postgres or real sockets — see below.

What still needs a manual pass before merge

Dev and unit tests use sails-disk, so the Postgres adapter isn't covered at all. Suggest running npm run docker:start (postgres:17, NODE_ENV=staging) + npm run e2e:server and checking:

• knex 0.12 → 2.4: anything past simple CRUD — signup/login, game create/join, and the stats/leaderboard queries. Confirm no ORM warnings on boot and that migrate: 'safe' + schema: true still match the existing schema.
• socket.io 2.0.3 → 2.5.0: connect/reconnect (reconnectSockets, io.sails.transports = ['websocket']) and each server-pushed event the client subscribes to — game, gameCreated, gameStarted, gameFinished, join, leftGame, setIsRanked. Also verify onlyAllowOrigins still rejects a disallowed origin under 2.5.0's stricter CORS handling.

Known residual (not addressed here)

Two plain lodash@3.10.1 copies remain, via machinepack-passwords@2.3.0 → machine@10.4.0 (and its rttc@7.4.0). npm audit reports fixAvailable: false — 2.3.0 is the latest stable, and its machine: ^10.3.1 pin holds it there. The only escape is the machinepack-passwords@3.0.0-0 prerelease, which swaps bcrypt-nodejs for bcryptjs; changing the password-hashing library is well out of scope for a dependency-security PR and would need its own hash-compatibility review.

Remaining npm audit findings otherwise sit in dev-only trees (storybook 7.6.0, handlebars, cypress) and the sails core tree (@sailshq/nedb, underscore, path-to-regexp).

🤖 Generated with Claude Code