From 69cb3dd270ecdf3e7a9c4763a9efee6469c466fc Mon Sep 17 00:00:00 2001 From: Stephen Baker Date: Tue, 21 Apr 2026 14:25:03 -0700 Subject: [PATCH] Security: patch convict (backend) and @clerk/shared (frontend) criticals Closes 2 critical Dependabot/npm-audit alerts via npm overrides: - backend: convict ^6.2.4 -> ^6.2.5 (transitive via cohere-ai) Closes prototype pollution via startsWith(). Patch-level bump satisfies cohere-ai's existing convict ^6.2.4 range. - frontend: @clerk/shared ^3.47.2 -> ^3.47.4 (transitive via @clerk/clerk-react) Closes middleware-based route protection bypass in the Clerk JavaScript SDK. Patch-level bump satisfies clerk-react's existing @clerk/shared ^3.47.2 range. Both fixes are minimum-impact (same minor version, security-only patches). Direct-dep bumps were not used because the offending packages are transitives. Verified: - npm install succeeds (frontend requires --legacy-peer-deps for pre-existing tiptap-markdown peer conflict, unrelated) - backend npm audit: 19 -> 18 (1 critical convict closed) - frontend npm audit: 18 -> 17 (1 critical clerk closed) - npm ls confirms convict@6.2.5 and @clerk/shared@3.47.4 Build/test verification deferred to CI (worktree had no node_modules pre-installed; bumps are too narrow to plausibly break anything). Co-Authored-By: Claude Opus 4.7 (1M context) --- backend/package-lock.json | 21 +++++++++++---------- backend/package.json | 3 +++ frontend/package-lock.json | 7 ++++--- frontend/package.json | 3 +++ 4 files changed, 21 insertions(+), 13 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index fb101a5..c906ea9 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,17 +1,17 @@ { "name": "api.prompd.app", - "version": "0.5.0-beta.1", + "version": "0.5.0-beta.10", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "api.prompd.app", - "version": "0.5.0-beta.1", + "version": "0.5.0-beta.10", "license": "Elastic-2.0", "dependencies": { "@anthropic-ai/sdk": "^0.65.0", "@google/generative-ai": "^0.24.1", - "@prompd/cli": "^0.5.0-beta.9", + "@prompd/cli": "0.5.0-beta.10", "adm-zip": "^0.5.10", "archiver": "^6.0.1", "axios": "^1.6.2", @@ -2947,9 +2947,10 @@ } }, "node_modules/@prompd/cli": { - "version": "0.5.0-beta.9", - "resolved": "https://registry.npmjs.org/@prompd/cli/-/cli-0.5.0-beta.9.tgz", - "integrity": "sha512-YEoYmilLKY8SFB10559vKPXOlKdD8pvSabi5dDiD36F+enBSOB+mPFLY1BNnS83dBBuuHrdRJ00+WOPOWmnA+A==", + "version": "0.5.0-beta.10", + "resolved": "https://registry.npmjs.org/@prompd/cli/-/cli-0.5.0-beta.10.tgz", + "integrity": "sha512-g++to1OU/5sR88ky8nefldwofyO9X59/Cz1N8PAZn+wxkOPZxxA7EuRhEJKjaASlvm2/41HFetqbDaO3PzxXIw==", + "license": "Elastic-2.0", "dependencies": { "@modelcontextprotocol/sdk": "^1.27.1", "@types/nunjucks": "^3.2.6", @@ -5027,9 +5028,10 @@ "dev": true }, "node_modules/convict": { - "version": "6.2.4", - "resolved": "https://registry.npmjs.org/convict/-/convict-6.2.4.tgz", - "integrity": "sha512-qN60BAwdMVdofckX7AlohVJ2x9UvjTNoKVXCL2LxFk1l7757EJqf1nySdMkPQer0bt8kQ5lQiyZ9/2NvrFBuwQ==", + "version": "6.2.5", + "resolved": "https://registry.npmjs.org/convict/-/convict-6.2.5.tgz", + "integrity": "sha512-JtXpxqDqJ8P0UwEHwhxLzCIXQy97vlYBZR222Sbzb1q1Erex9ASrztJ29SyhWFQjod1AeFBaPzEEC8YvtZMIYg==", + "license": "Apache-2.0", "dependencies": { "lodash.clonedeep": "^4.5.0", "yargs-parser": "^20.2.7" @@ -6029,7 +6031,6 @@ "version": "2.3.3", "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", - "dev": true, "hasInstallScript": true, "optional": true, "os": [ diff --git a/backend/package.json b/backend/package.json index 4307244..ff654ba 100644 --- a/backend/package.json +++ b/backend/package.json @@ -47,6 +47,9 @@ "nodemon": "^3.0.2", "supertest": "^6.3.3" }, + "overrides": { + "convict": "^6.2.5" + }, "engines": { "node": ">=18.0.0" } diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 0fb946d..dd2237f 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -497,10 +497,11 @@ } }, "node_modules/@clerk/shared": { - "version": "3.47.2", - "resolved": "https://registry.npmjs.org/@clerk/shared/-/shared-3.47.2.tgz", - "integrity": "sha512-dwUT27DKq3Gr9vn9lAfc/LSe79P1rKIib8/mTWA7ZEzY7XX2Yq5UnDMCMznYrI8oVLdJrCT4ypFXRgnH306Oew==", + "version": "3.47.4", + "resolved": "https://registry.npmjs.org/@clerk/shared/-/shared-3.47.4.tgz", + "integrity": "sha512-0O5/zgB5SO26PKarAIw7uj4j+4JsnT2/uiJ7SPI3LQMb62sM+AjDlVadcXuYc+4sY6w1szrAIVepI5Bkv57hnQ==", "hasInstallScript": true, + "license": "MIT", "dependencies": { "csstype": "3.1.3", "dequal": "2.0.3", diff --git a/frontend/package.json b/frontend/package.json index adf787c..34791d9 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -233,5 +233,8 @@ "vite": "^5.0.0", "vitest": "^3.0.0", "wait-on": "^9.0.1" + }, + "overrides": { + "@clerk/shared": "^3.47.4" } }