You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Baoyuantop (via GitHub)" <gi...@apache.org> on 2026/04/02 03:16:54 UTC
[PR] fix: resolve Dependabot security alerts for transitive dependencies [apisix-dashboard]
Baoyuantop opened a new pull request, #3364:
URL: https://github.com/apache/apisix-dashboard/pull/3364
## Description
Resolve all 7 open Dependabot security alerts by adding pnpm overrides for vulnerable transitive dependencies.
### Security Fixes
| Package | Vulnerable Version | Patched Version | Severity | CVE Summary |
|---------|-------------------|----------------|----------|-------------|
| `path-to-regexp` | 8.2.0 | 8.4.2 | high/medium | ReDoS via wildcards and sequential optional groups |
| `brace-expansion` | 5.0.4 | 5.0.5 | medium | Zero-step sequence causes process hang and memory exhaustion |
| `picomatch` | 2.3.1 / 4.0.3 | 4.0.4 | high/medium | ReDoS via extglob quantifiers; method injection in POSIX character classes |
### Changes
- Added `path-to-regexp`, `brace-expansion`, and `picomatch` to `pnpm.overrides` in `package.json`
- Updated `pnpm-lock.yaml` accordingly
### Verification
- `pnpm build` ✅
- `pnpm lint` ✅
- All vulnerable packages resolved to patched versions verified via `pnpm why`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: resolve Dependabot security alerts for transitive dependencies [apisix-dashboard]
Posted by "LiteSun (via GitHub)" <gi...@apache.org>.
LiteSun commented on code in PR #3364:
URL: https://github.com/apache/apisix-dashboard/pull/3364#discussion_r3026853545
##########
package.json:
##########
@@ -108,7 +108,10 @@
"diff": ">=8.0.3",
"@swc/core": "1.10.0",
"flatted": ">=3.4.2",
- "undici": ">=6.24.0"
+ "undici": ">=6.24.0",
+ "path-to-regexp": ">=8.4.0",
+ "brace-expansion": ">=5.0.5",
+ "picomatch": ">=4.0.4"
Review Comment:
2.3.1 / 4.0.3 Will there be any compatibility issues if everything is forcibly upgraded to version 4.0.4?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: resolve Dependabot security alerts for transitive dependencies [apisix-dashboard]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop merged PR #3364:
URL: https://github.com/apache/apisix-dashboard/pull/3364
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: resolve Dependabot security alerts for transitive dependencies [apisix-dashboard]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on code in PR #3364:
URL: https://github.com/apache/apisix-dashboard/pull/3364#discussion_r3031139330
##########
package.json:
##########
@@ -108,7 +108,10 @@
"diff": ">=8.0.3",
"@swc/core": "1.10.0",
"flatted": ">=3.4.2",
- "undici": ">=6.24.0"
+ "undici": ">=6.24.0",
+ "path-to-regexp": ">=8.4.0",
+ "brace-expansion": ">=5.0.5",
+ "picomatch": ">=4.0.4"
Review Comment:
Good catch! You're right — a blanket `>=4.0.4` override would force picomatch 4.x on chokidar 3.x consumers (anymatch/readdirp) that originally depended on picomatch 2.x, which could introduce compatibility issues since picomatch 4.x is a major version bump.
I've updated the approach to use **targeted overrides**:
- `"anymatch>picomatch": "2.3.2"` — pins chokidar's anymatch dependency to the patched 2.x version
- `"readdirp>picomatch": "2.3.2"` — same for chokidar's readdirp dependency
- `"picomatch": ">=4.0.4"` — upgrades all other consumers (tinyglobby, vite, unplugin, fdir) that already use picomatch 4.x
Verified via `pnpm why picomatch`:
- chokidar path → picomatch **2.3.2** ✅
- all other paths → picomatch **4.0.4** ✅
Build and lint both pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org