mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-09 14:38:59 +02:00
Garry TanandClaude Fable 5
ddcd4073ef
Root: overrides pin ip-address 10.3.1 (defeats BOTH nested nodes — socks' range pull and express-rate-limit's exact 10.1.0 pin, which a top-level bump provably cannot reach) and sharp 0.35.0 (GHSA-f88m, HIGH; transformers still pins ^0.34 upstream — smoke-tested round-trip); marked ^18.0.11; full in-range lockfile refresh clears hono, fast-uri, protobufjs, qs, body-parser, nanoid, uuid, immutable and friends. lib/diagram-render (via its own build-script contract: exact pins edited, fresh lock, dist rebuilt): mermaid 11.16.1, @excalidraw/excalidraw 0.18.1, @excalidraw/mermaid-to-excalidraw 1.1.2 → 2.2.2 — the 1.x line exact-pinned mermaid 10.9.x and dragged the entire duplicate mermaid-10 advisory chain (dompurify 3.1.6, nanoid 3.3.3, lodash-es); the bundle shrinks 9.96 → 7.59 MB with the duplicate mermaid gone. Nested exact pins that survived get scoped overrides (nanoid 5.1.16, lodash-es 4.18.1). Verification: clean-worktree frozen-lockfile installs (root + nested) + the SAME osv-scanner release the action pins (v2.3.8) with the workflow's exact scan-args → exit 0, 'No issues found'. Smoke tests cover the override surfaces (sharp round-trip, ip-address lockfile assertion, marked parse); socks + diagram-drift suites already pin the rest. Supersedes #2695 (its own lockfile kept socks/ip-address@10.2.0; @anupamme's report credited for the parallel diagnosis). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
44 lines
1.8 KiB
TypeScript
44 lines
1.8 KiB
TypeScript
/**
|
|
* Dependency-override smoke tests (v1.78.0.0 dependency wave).
|
|
*
|
|
* The wave's `overrides` entries (package.json: ip-address 10.3.1,
|
|
* sharp 0.35.0; lib/diagram-render: nanoid 5.x, lodash-es 4.18.x) defeat
|
|
* nested exact pins, so a green unit suite alone does not prove the forced
|
|
* versions actually work for their consumers. These smokes exercise the
|
|
* overridden surfaces directly. SOCKS is covered by
|
|
* browse/test/socks-bridge.test.ts; the diagram bundle by
|
|
* test/diagram-render-drift.test.ts + the paid diagram E2E.
|
|
*/
|
|
import { describe, expect, test } from "bun:test";
|
|
|
|
describe("dependency-wave smoke", () => {
|
|
test("sharp 0.35 override: import + metadata + resize round-trip", async () => {
|
|
const sharp = (await import("sharp")).default;
|
|
// 1x1 red PNG.
|
|
const png = Buffer.from(
|
|
"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
|
|
"base64",
|
|
);
|
|
const meta = await sharp(png).metadata();
|
|
expect(meta.width).toBe(1);
|
|
const out = await sharp(png).resize(4, 4).png().toBuffer();
|
|
const outMeta = await sharp(out).metadata();
|
|
expect(outMeta.width).toBe(4);
|
|
});
|
|
|
|
test("ip-address 10.3.1 override: both nested consumers resolve the fixed version", async () => {
|
|
const lock = await Bun.file(`${import.meta.dir}/../bun.lock`).text();
|
|
// No vulnerable ip-address node may survive anywhere in the tree
|
|
// (socks pulled 10.2.0; express-rate-limit exact-pinned 10.1.0 — the
|
|
// override must defeat both).
|
|
expect(lock).not.toMatch(/ip-address@10\.(1|2)\./);
|
|
expect(lock).toMatch(/ip-address@10\.3\./);
|
|
});
|
|
|
|
test("marked stays importable and parses (direct-dep bump)", async () => {
|
|
const { marked } = await import("marked");
|
|
const html = await marked.parse("**b**");
|
|
expect(html).toContain("<strong>b</strong>");
|
|
});
|
|
});
|