Repository navigation
fix(deps): patch axios, undici and supplemental security advisories - #70
zedarvates wants to merge 3 commits into
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
zedarvates
left a comment
zedarvates
left a comment
There was a problem hiding this comment.
Security/dependency review completed on 2026-10-03, anchored to 99feb3319e35a896bbdb4505a02a9fa452380329. Reviewed #70 first, then the focused Electron patch #63. This is a COMMENT review: the dependency findings below are verified; full application acceptance remains incomplete.
Exact advisory coverage
The fresh npm lockfile audits on the common code base used by #63 expose 12 Axios and 10 Undici advisory IDs affected by the versions that #70 replaces. #70 resolves Axios 1.20.0 in all three roots, Undici 6.29.0 under node-gyp in root/config and 7.30.0 at all three roots. Every applicable installed copy in the reviewed locks is above the affected ranges below.
Axios before this patch: root/config 1.19.0; Creative Studio 1.18.0.
| Advisory | Affected range returned by npm | Issue class |
|---|---|---|
| GHSA-vh66-26gq-q6x8 | >=1.7.0 <1.20.0 |
Fetch adapter request pollution |
| GHSA-9fr6-4gfg-395g | >=1.0.0 <1.20.0 |
Inherited HTTP method |
| GHSA-c29m-xwm3-cm6r | >=1.16.1 <1.20.0 |
data: URL parser DoS |
| GHSA-mghh-pgcx-3jjj | >=1.15.0 <1.20.0 |
Proxy host-normalization DoS |
| GHSA-x97p-jq2g-jp4f | >=1.15.1 <1.20.0 |
toFormData option pollution |
| GHSA-3pq3-5fj3-cg6v | >=1.13.0 <1.20.0 |
HTTP/2 DNS/proxy bypass |
| GHSA-542g-h47m-68v8 | >=1.13.0 <1.20.0 |
HTTP/2 unhandled session error |
| GHSA-j8rh-479h-cp32 | >=1.0.0 <1.20.0 |
Inherited header injection after interceptor |
| GHSA-4hqw-qxg8-jxx2 | >=1.12.0 <1.20.0 |
Inherited FormData headers |
| GHSA-m8m8-qj5v-23w3 | >=1.15.2 <1.20.0 |
Inherited socket constructor |
| GHSA-44g4-m2mj-wpvx | >=1.15.0 <1.20.0 |
Ignored CIDR NO_PROXY |
| GHSA-r4gj-5m52-g5wh | >=1.17.0 <1.20.0 |
Fetch maxRedirects bypass |
Undici before this patch: 6.28.0 under node-gyp in root/config; 7.29.0 at root/config/Creative Studio.
| Advisory | Affected range returned by npm | Issue class |
|---|---|---|
| GHSA-3wwx-pv8p-q78v | >=6.25.0 <6.28.1; >=7.28.0 <7.29.1 |
WebSocket decompression error |
| GHSA-pmjh-fq2x-6v4x | >=7.11.0 <7.29.1 |
Orphaned retry response body |
| GHSA-r53p-7pc4-xj5r | <6.28.1; >=7.0.0 <7.29.1 |
Retry response splitting |
| GHSA-rfgv-xxqx-mfg5 | >=6.7.0 <6.28.1; >=7.0.0 <7.29.1 |
Unrequested WebSocket subprotocol |
| GHSA-3xpg-4rpp-hhhm | >=7.15.0 <7.29.1 |
Unbounded response decompression |
| GHSA-2jfj-6hjv-fm6j | >=7.0.0 <7.29.1 |
Shared-cache cookie disclosure |
| GHSA-2gqq-gqf2-x968 | >=7.1.0 <7.29.1 |
Dump-interceptor response truncation |
| GHSA-w293-vg96-wgc3 | >=7.24.1 <7.29.1 |
BalancedPool TLS validation bypass |
| GHSA-8436-99hf-9mmv | >=7.0.0 <7.29.1 |
Unsafe-method response caching |
| GHSA-rx4f-c7p8-82vq | >=7.0.0 <7.29.1 |
WebSocketStream unclean-close DoS |
Fresh npm audit --json on the exact #70 locks has no Axios or Undici finding in any of the three roots. It still flags Electron 41.10.3, covered separately by #63. Repository-private Dependabot alert numbers/statuses are not exposed by the available GitHub API route; this is an advisory-to-lockfile verification, not a claim that GitHub has closed numbered alerts.
Executed npm and compatibility evidence
- Node 24.19.0 / npm 11.9.0:
npm ci --ignore-scripts --no-audit --no-fundpassed at root and config. Creative Studio passed with the additional--legacy-peer-depsflag; strict peer resolution was not verified. npm ls axios undici electron --allconfirmed the target versions at root. All three lockfiles were inspected for every target copy and matching manifest dependency declarations. Axios's updated form-data requirement is satisfied by locked form-data 4.0.6.- A local HTTP echo test passed for Axios POST/JSON and both Undici versions; a 1×1 Sharp 0.35.4 PNG conversion passed on host Node.
- #70 applies cleanly on #63 in a separate local checkout. The combined locks install successfully in all three roots with the same UI flag. Under Electron 41.10.6 / embedded Node 24.18.0, the same HTTP and native-image smoke exits successfully.
- Sharp's Linux/Electron warning and GLib critical messages occur in the successful image smoke on both 41.10.3 and 41.10.6. The bounded test did not reveal a new warning regression; this remains a native-runtime limitation, not full Electron compatibility approval.
Quality evidence and remaining blockers
The SonarCloud check is successful on 99feb3319e35a896bbdb4505a02a9fa452380329. GitHub exposes no npm/Electron Actions check on this head. The green static-analysis gate does not replace the executed npm audit or runtime acceptance.
Root electron:build fails on missing ./SplashWindow; config's script points to absent electron/tsconfig.json. Creative Studio build:check reports 2,147 TypeScript diagnostics on #70 and the local #70+#63 combination; the diagnostics are identical after checkout-path normalization. A GUI/application start, renderer security behavior, Windows/macOS and packaged-app behavior were not tested.
Combined audit result after both patches: no Axios, Undici or Electron finding, but 39 / 39 / 7 affected-package entries remain at root/config/Creative Studio, respectively (npm's aggregate count, not distinct GHSA or GitHub-alert count). Those are separate findings; do not claim a clean repository-wide audit.
Before merge, the remaining decision is acceptance of the documented build/GUI/native gaps and verification of GitHub's private alert closure on the eventual merged head. No runtime guarantee follows from this lockfile patch.
zedarvates
left a comment
zedarvates
left a comment
There was a problem hiding this comment.
Follow-up verification — 2026-10-03
The root Electron TS2307 blocker has a separate draft repair in #73, head 3a8cac25a11ed207192d443562f899cecb54aede. Its current-head CI run passes installation, 13 splash lifecycle tests and compilation on Node 22.12.0/24.19.0. The Linux splash smoke passes with Electron 41.10.3 / embedded Node 24.18.0; Xvfb/--no-sandbox limits the claim to the splash document/progress/close lifecycle. Sonar is also successful for that repair SHA.
Local combination of exact #70 99feb3319e35a896bbdb4505a02a9fa452380329 and exact #63 ca5b890a4fe010065a76294506abbde0b293ec3c, plus the #73 source patch: root/Studio npm installations, root Electron compile and 13 splash unit tests pass with Electron 41.10.6, Axios 1.20.0 and Undici 6.29.0/7.30.0. This combination is not the head of either dependency PR and has no GitHub check of its own.
Remaining Studio gap is tracked in #74: Vite still fails on missing ComfyUIProvider; strict typecheck still yields 2,147 diagnostics, byte-identical to the baseline. Source/renderer contracts and missing editor stores need restoration before complete desktop acceptance. The legacy config/package.json scripts are not a second runnable launcher entry point.
#73 remains draft and is not incorporated into this dependency PR's unchanged head, so its green checks do not replace current-head build evidence here. Review/apply the launcher repair and obtain fresh build/renderer evidence before accepting the desktop behavior. The precise GHSA coverage in the prior review remains unchanged; this follow-up does not establish private alert closure or full-platform/runtime security acceptance.
zedarvates
changed the title
|
1 participant
Dependabot reports vulnerable Axios and Undici on main. This PR resolves Axios 1.20.0 and Undici 6.29.0/7.30.0 across root, config and Creative Studio. It also patches brace-expansion, DOMPurify, source-map-js, sharp, fast-uri and http-cache-semantics. Root/config override shell-quote to ^1.12.0, removing critical GHSA-pqg4-j6r4-53mv. Creative Studio overrides postcss-selector-parser to ^7.1.6 while retaining the existing Tailwind 3 pipeline.
Electron 41.10.6 is handled separately in #63; this PR preserves its original entries so that change remains independently reviewable. Python ecdsa removal is in draft #80.
Validation:
Remaining limits: