Skip to content

engineering: Various CVE updates#670

Merged
frhuelsz merged 15 commits into
mainfrom
user/frhuelsz/cve/patching
Jun 2, 2026
Merged

engineering: Various CVE updates#670
frhuelsz merged 15 commits into
mainfrom
user/frhuelsz/cve/patching

Conversation

@frhuelsz
Copy link
Copy Markdown
Contributor

@frhuelsz frhuelsz commented Jun 2, 2026

🔍 Description

Various CVE updates across Trident and docs website.

frhuelsz and others added 14 commits June 2, 2026 12:10
Resolves Dependabot alert #94 (GHSA-3pv8-6f4r-ffg2): tar has a PAX
header desynchronization issue.

Workspace dependency was pinned to 0.4.43; lockfile was at 0.4.45.
Bumps workspace minimum and lockfile to 0.4.46 (patch within 0.4.x).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alerts #70, #71, #72, #73, #74, #77, #78, #87:

- GHSA-phqj-4mhp-q6mq: Potential out-of-bounds write in
  CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (#87)
- GHSA-xv59-967r-8726: Heap buffer overflow when encrypting with AES
  key-wrap-with-padding (#78)
- GHSA-xp3w-r5p5-63rr: Undefined behavior in X509Ref::ocsp_responders
  for certificates with non-UTF-8 OCSP URLs (#77)
- GHSA-pqf5-4pqq-29f5: Deriver::derive and PkeyCtxRef::derive can
  overflow short buffers on OpenSSL 1.1.1 (#74)
- GHSA-xmgf-hq76-4vx2: Out-of-bounds read in PEM password callback
  when returning an oversized length (#73)
- GHSA-8c75-8mhr-p7r9: Incorrect bounds assertion in AES key wrap (#72)
- GHSA-hppc-g8h3-xhp3: Unchecked callback length in PSK/cookie
  trampolines leaks adjacent memory to peer (#71)
- GHSA-ghm9-cr32-g9qj: MdCtxRef::digest_final() writes past caller
  buffer with no length check (#70)

Patch updates within the 0.10.x line; also bumps openssl-sys
0.9.107 -> 0.9.116.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #68 (GHSA-cq8v-f236-94qc): Rand is unsound
with a custom logger using rand::rng() (affects 0.9.0 - 0.9.2).

Patch update within the 0.9.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #69 (GHSA-cq8v-f236-94qc): Rand is unsound
with a custom logger using rand::rng() (affects 0.7.0 - 0.8.5).

Patch update within the 0.8.x line, pulled in transitively via
phf_generator. Cargo.lock-only change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alerts #22, #29, #92:

- GHSA-6rw7-vpxm-498p: qs arrayLimit bypass in bracket notation
  allows DoS via memory exhaustion (#22)
- GHSA-w7fw-mjwx-w883: qs arrayLimit bypass in comma parsing allows
  denial of service (#29)
- GHSA-q8mj-m7cp-5q26: qs.stringify crashes with TypeError on
  null/undefined entries in comma-format arrays (#92)

Pinned via npm overrides to dedupe the two pulled-in versions
(6.13.0 and 6.14.1) to 6.15.2. Patch within the 6.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #88 (GHSA-qx2v-qp2m-jg93): PostCSS has XSS
via unescaped </style> in its CSS stringify output.

Pinned via npm overrides from 8.5.6 to 8.5.10. Patch within 8.5.x.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #89 (GHSA-58qx-3vcg-4xpx): ws has an
uninitialized memory disclosure (affects 8.0.0 - 8.20.0).

Scoped override 'ws@^8.0.0' bumps the webpack-dev-server copy from
8.18.3 to 8.20.1. The unrelated ws@7.5.10 copy under
webpack-bundle-analyzer is left intact (not in the vulnerable
range). Patch within the 8.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #91 (GHSA-w5hq-g745-h8pq): uuid has a
missing buffer bounds check in v3/v5/v6 when buf is provided.

Pinned via npm overrides. Two installed copies were affected:
- sockjs's uuid@8.3.2 (pulled in via webpack-dev-server)
- mermaid's uuid@11.1.0

Both consumers call uuid.v4() exclusively, an API stable across the
major-version range. Verified the docusaurus build still succeeds
after the override.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alerts #37 and #90:

- GHSA-5c6j-r48x-rmvq: serialize-javascript is vulnerable to RCE via
  RegExp.flags and Date.prototype.toISOString() (#37)
- GHSA-qj8w-gfj5-8c6v: serialize-javascript has CPU exhaustion DoS
  via crafted array-like objects (#90)

Pinned via npm overrides from 6.0.2 to 7.0.5. The 6.x line receives
no patches; the only breaking change between 6 and 7 is removal of
the default isJSON option, which the consumers (copy-webpack-plugin
and css-minimizer-webpack-plugin) do not rely on. Verified the
docusaurus build still succeeds after the override.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #86 (GHSA-79cf-xcqc-c78w):
webpack-dev-server vulnerable to cross-origin source code exposure
on non-HTTPS origins.

Pinned via npm overrides from 5.2.2 to 5.2.4. Patch within the
5.2.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #81 (GHSA-fv7c-fp4j-7gwp):
@babel/plugin-transform-modules-systemjs generates arbitrary code
when compiling malicious input (affects 7.12.0 - 7.29.3).

Pinned via npm overrides from 7.27.1 to 7.29.4. Minor update within
the 7.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alert #63 (GHSA-r4q5-vmmm-2653):
follow-redirects leaks custom authentication headers to cross-domain
redirect targets.

Pinned via npm overrides from 1.15.11 to 1.16.0. Minor update
within the 1.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alerts #60 and #61:

- GHSA-r5fr-rjxr-66jc: lodash vulnerable to code injection via
  _.template imports key names (#60)
- GHSA-f23m-r3pf-42rh: lodash vulnerable to prototype pollution via
  array path bypass in _.unset and _.omit (#61)

Pinned via npm overrides from 4.17.23 to 4.18.1. The advisory lists
4.18.0 as the first patched version, but the npm registry marks
4.18.0 as a bad release and recommends 4.18.1, so the minimum
usable patched version is 4.18.1. Minor update within the 4.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves Dependabot alerts #34, #35, #36:

- GHSA-3ppc-4f35-3m26: minimatch ReDoS via repeated wildcards with
  non-matching literal in pattern (#34)
- GHSA-7r86-cg39-jmmj: minimatch ReDoS - matchOne() combinatorial
  backtracking via multiple non-adjacent GLOBSTAR segments (#35)
- GHSA-23c5-xmqv-rm74: minimatch ReDoS - nested *() extglobs generate
  catastrophically backtracking regular expressions (#36)

Scoped override 'minimatch@^3.0.0' bumps the serve-handler copy
from 3.1.2 to 3.1.4 while leaving any future 4.x+ copies unaffected.
Patch within the 3.x line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frhuelsz frhuelsz requested a review from a team as a code owner June 2, 2026 20:23
Copilot AI review requested due to automatic review settings June 2, 2026 20:23
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates dependency versions and lockfiles to address CVEs across the Rust workspace and the Docusaurus website.

Changes:

  • Added/updated npm overrides for vulnerable transitive dependencies in website/package.json, with corresponding package-lock.json refresh.
  • Bumped Rust crate versions in Cargo.toml (notably openssl, rand, and tar) and updated Cargo.lock accordingly.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

File Description
website/package.json Adds npm overrides to force patched dependency versions.
website/package-lock.json Regenerates lockfile to reflect updated/patched dependency graph.
Cargo.toml Updates Rust dependency versions to patched releases.
Cargo.lock Updates resolved Rust crate versions/checksums to match Cargo.toml.
Files not reviewed (1)
  • website/package-lock.json: Language not supported

Comment thread website/package.json
fintelia
fintelia previously approved these changes Jun 2, 2026
@bfjelds
Copy link
Copy Markdown
Member

bfjelds commented Jun 2, 2026

might be worth using RUN_ID=26845832575 make validate-pipeline-website-artifact to make sure the docs build with the new packages.

nevermind ... i ran it and things look ok.

bfjelds
bfjelds previously approved these changes Jun 2, 2026
The installed dependency tree has long required Node 20+ (the entire
Docusaurus 3.9 stack declares 'engines.node: >=20.0', and the CI
workflow .github/workflows/deploy-website.yaml already pins
node-version: 20.x), but the website package itself still advertised
'engines.node: >=18.0'.

The recent serialize-javascript 6 -> 7 bump (commit decdb0c,
resolving Dependabot alerts #37 and #90) makes the strictness
explicit: serialize-javascript@7 declares 'engines.node: >=20.0.0'.

Align the website's engines field with what the deps and CI already
require so npm install gives a consistent signal to contributors and
to lockfile metadata.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frhuelsz frhuelsz dismissed stale reviews from bfjelds and fintelia via 23b4ffd June 2, 2026 21:42
@frhuelsz frhuelsz merged commit 60e0fc8 into main Jun 2, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants