Conversation
…s/faker bumps (ESM-only sub-deps break Jest CJS tests)
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
11 fixed, 1 ignored, 1 deferred, 2 resolutions added, 0 resolutions removed, 5 could-not-auto-fix. | label: 🔒 security applied
Fixed
**/@nestjs/platform-express/multer: ^2.3.0(only reached via_example→@nestjs/platform-express)@forestadmin/forest-cloud(^17.13.4→^17.13.6) + resolution**/forest-cli/joibumped**/@modelcontextprotocol/sdk/hono: ^4.13.5(only reached via@modelcontextprotocol/sdk)js-yamlresolutions bumped from^4.3.1to^4.3.2(lerna,cosmiconfig,eslint,@eslint/eslintrc,@semrel-extra/topo,@hey-api/json-schema-ref-parser), plus new**/@redocly/openapi-core/js-yaml: ^4.3.2for the redoc chainjs-yaml@3.xresolutions bumped from^3.15.1to^3.15.2(@oclif/core,@istanbuljs/load-nyc-config)Ignored
first_patched_versionis null in the advisory). Direct dep of@forestadmin/forest-cloudat^0.6.0; nothing to bump to.Deferred
Resolutions added
hono: ^4.13.5@forestadmin/ai-proxy→@modelcontextprotocol/sdk@^1.28.0→hono@^4.11.4^4.11.4) already admits 4.13.5; the lockfile just needed to be pushed forward. No parent bump would move it — the constraint is upstream lockfile inertia, not an SDK dep range.**/@modelcontextprotocol/sdk/honomulter: ^2.3.0example(packages/_example) →@nestjs/platform-express@^11.1.24→multer@2.2.0@nestjs/platform-expresspinsmulterto a specific 2.x version internally; no ancestor bump within Nest 11.x pulls the patched sub-dep._exampleintentionally pins Nest to demo backward compatibility, so a resolution keeps_exampleunchanged.**/@nestjs/platform-express/multerResolutions removed
None — this run did not identify stale or redundant entries. (Not audited exhaustively; deferred to a future hygiene pass.)
Could not auto-fix
@forestadmin/agent-bffdirect dep2.17.5 → 2.17.7.packages/agent/test/bff/embedded-bff.e2e.test.ts) failed withMust use import to load ES Module: node_modules/sanitize-html/node_modules/htmlparser2/dist/index.js—sanitize-html@2.17.6+requireshtmlparser2@^12which is ESM-only, and the affected Jest suite runs in CJS mode. Fixing this requires reconfiguring the agent package's Jest ESM setup — out of scope for a security bump. Bump reverted.@forestadmin/datasource-demo-fintechdirect dep^9.0.0 → ^10.5.0.packages/datasource-demo-fintech/test/index.test.tsfailed withSyntaxError: Cannot use import statement outside a module—@faker-js/faker@10.xis ESM-only, and the package's Jest config resolves it via the CJS loader. Fixing this requires reconfiguring Jest / ts-jest for ESM in that workspace — out of scope for a security bump. Bump reverted. Note: usage insrc/seed/utils.tsis limited tofaker.number.*andfaker.helpers.arrayElement/arrayElements/shuffle, none of which touches the vulnerablehelpers.fakeAPI — the actual exploit is not reachable from our code.sanitize-html@2.17.6(the minimum patched version) already pulls inhtmlparser2@^12.Risks
joi17.13.4 → 17.13.8 is a minor+patch bump; two prototype-pollution fixes (object().renamewith a template target;__proto__key in custommessages). No behavior change for typical validation code.multer2.2.0 → 2.4.0 upgrades three DoS-hardening patches within Nest's platform-express chain._exampleis the only consumer.hono4.13.3 → 4.13.8 is a patch-level chain of fixes (query fragment parsing,parseBodynesting bound,toSSGpath traversal). MCP SDK's own range already permits it.js-yaml4.3.1 → 4.3.2 and 3.15.1 → 3.15.2 is a patch-level fix formaxTotalMergeKeysCPU cost on empty merge sources. Behavior change is limited to inputs that were already pathological.Manual testing
Covered by CI.
Validation
✅ CI green (Actions + commit statuses; app-based checks not monitored)