mirror of
https://github.com/civitai/civitai.git
synced 2026-09-20 22:08:18 +08:00
Zachary Lowden
bf7331e553
Dev-tooling only. No runtime dependency moves, no source change.
Clears 4 Dependabot alerts, all CRITICAL, all `scope=development`:
#331 CVE-2026-73653 @vitest/browser provider commands bypass file-access
#272 CVE-2026-53633 @vitest/browser Browser Mode API can proxy CDP
#269 CVE-2026-47428 @vitest/browser unsanitized otelCarrier query param
#264 CVE-2026-47429 vitest UI server arbitrary file read/exec
Confirmed against the regenerated lockfile, not estimated: every open alert
was re-evaluated by resolving each advisory's vulnerable ranges against the
`packages:` set of the lockfile before and after. 4 cleared, 0 introduced,
0 other alerts moved.
WHY THE WHOLE FAMILY MOVES, not just the two named packages. The vitest
packages peer-depend on each other by EXACT version (`vitest: 4.0.18`, not a
range). Bumping only `vitest` and `@vitest/browser` leaves
`@vitest/browser-playwright@4.0.18` — which is pinned exactly in the manifest
— pulling a second, still-vulnerable `@vitest/browser@4.0.18` into the tree
alongside the new one, so the alerts do NOT clear. Measured: that resolution
keeps `@vitest/browser@4.0.18` and reports `unmet peer vitest@4.0.18`. Moving
`vitest`, `@vitest/browser`, `@vitest/browser-playwright` and
`@vitest/coverage-v8` together is what leaves a single 4.1.11 of each.
The 20 changed manifest lines are version strings only. `pnpm up` was not used
to produce them: it also re-sorts dependency keys alphabetically, which added
unrelated churn to two files. The floors move `^4.0.18` -> `^4.1.11` so a fresh
resolve cannot land back on a vulnerable version.
Test matrix — `origin/main` @ df7733b99c vs this branch, same toolchain:
suite baseline after
typecheck 0 errors 0 errors
unit 20407 passed / 25 skipped (1301) 20407 passed / 25 skipped (1301)
packages 1079 passed / 8 skipped (78) 1079 passed / 8 skipped (78)
apps 691 passed / 35 skipped (68) 691 passed / 35 skipped (68)
Identical counts on every suite. The baseline was recorded first, on an
unmodified checkout, with a green `pnpm install --frozen-lockfile` as the
control.
NOT TOUCHED, deliberately:
fast-xml-parser — alert #137 (critical) is left open ON PURPOSE. The
`"@aws-sdk/core>fast-xml-parser": "5.2.5"` override pins the vulnerable
version because a blanket CVE bump of this package broke S3 error parsing in
production once already (#3267). Both entries are byte-identical to `main`
here. Clearing #137 needs the parsing regression fixed first, not a bump.
nodemailer — declared `^6.8.0` against a top fix of 9.0.1. A three-major
bump of the email path is not a lockfile refresh; out of scope.
The only unstaged file after this change is `packages/civitai-db-schema/src/enums.ts`,
which the `postinstall` generator rewrites on an unmodified `main` too. It is
pre-existing drift, so it is left out of this commit rather than smuggled in.
38 lines
929 B
JSON
38 lines
929 B
JSON
{
|
|
"name": "@civitai/notifications-app",
|
|
"version": "0.0.12",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "./dist/server.js",
|
|
"scripts": {
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsup",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@civitai/axiom": "workspace:*",
|
|
"@civitai/db": "workspace:*",
|
|
"@civitai/db-schema": "workspace:*",
|
|
"@civitai/notifications": "workspace:*",
|
|
"@civitai/redis": "workspace:*",
|
|
"dayjs": "^1.11.13",
|
|
"fastify": "^5.2.1",
|
|
"lodash-es": "^4.17.21",
|
|
"pg-format": "^1.0.4",
|
|
"prom-client": "^14.2.0",
|
|
"zod": "^4.0.17"
|
|
},
|
|
"devDependencies": {
|
|
"@types/lodash-es": "^4.17.7",
|
|
"@types/node": "^20.19.9",
|
|
"@types/pg": "^8.11.10",
|
|
"@types/pg-format": "^1.0.5",
|
|
"tsup": "^8.5.0",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^5.9.2",
|
|
"vitest": "^4.1.11"
|
|
}
|
|
}
|