Security dependency refresh: npm audit 106 -> 57 (master) - #192
Merged
Conversation
Same refresh applied to alpha (branch deps/security-refresh). master and alpha
started from identical versions of all three bumped deps and share the same
usage sites, so the change is byte-identical in package.json.
Lockfile-only in-range updates (npm audit fix --package-lock-only) plus three
manifest bumps. No first-party code changes.
- ejs ^2.7.4 -> ^3.1.10 The 2->3 break is removal of old-style
"<% include x %>". views/ has zero includes; all 5
templates compile clean on 3.1.10.
- nodemailer ^6.10.1 -> ^9.0.5
lib/mailer.js uses only createTransport (sendmail,
SMTP, auth, tls) and callback-style sendMail. All
verified on 9.0.5. Clears a critical (command
injection < 6.4.16).
- nconf ^0.10.0 -> ^0.13.0
config.js is the sole consumer; verified the chained
argv().env().file().defaults() resolves identically.
Deliberately NOT bumped (breaking, need their own change): redis 2->4 removes
the callback API used in rpc/proteinFamily.js and routes/dataRouter.js;
forever/pm2 are ops tooling imported by no app code; request-promise has no
fix and needs porting to axios; mocha 7->11 is dev-only.
Most of the remaining 57 are unreachable from here: 6 criticals are nested
copies inside the p3-user git dep (being fixed upstream), 11 are pm2/forever
trees, 3 are vendored inside npm itself. Direct axios is already latest and
clean; its alert is @pm2/js-api's pinned 0.21.4.
The rationale, do-not-bump list, and re-run procedure are documented in
CLAUDE.md on the alpha branch; master has no CLAUDE.md, so that doc is
deliberately omitted here to avoid conflicting with the later alpha->master
merge.
The 9 open dependabot PRs (#117 #118 #123 #124 #125 #126 #128 #129 #133) are
obsolete: 2022-2023 vintage, all target master, all conflicting, every package
already patched or superseded here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the same dependency refresh as #191 (which targets
alpha) tomaster, so the twolines don't diverge before the eventual
alpha→mastermerge.npm audit: 106 → 57 (critical 15→11, high 59→24) — identical numbers to the alpha run,because
masterandalphastart from identical versions of all three bumped deps and sharethe same usage sites.
package.jsondiff is byte-identical to #191's.What changed
Most of the win came from
npm audit fix --package-lock-only(no manifest edits). Threemanifest entries moved:
ejs^2.7.4^3.1.10<% include x %>.master'sviews/has zero includes; all 5 templates compile clean under 3.1.10 (verified against master's own copies).nodemailer^6.10.1^9.0.5lib/mailer.jsuses onlycreateTransport(sendmail / SMTP / auth / tls) and callback-stylesendMail. Clears a critical command-injection advisory.nconf^0.10.0^0.13.0config.jsis the sole consumer — one chainedargv().env().file().defaults().Deliberately not bumped
redis2→4 (removes the callback API used inrpc/proteinFamily.jsandroutes/dataRouter.js),forever/pm2(ops tooling, imported by no app code),request-promise/request(no fix exists; needs porting toaxios),mocha7→11(dev-only). Each needs its own change with real testing.
Remaining 57
6 of the 11 criticals are nested copies inside the
p3-usergit dependency (being fixedupstream now); 11 are
pm2/forevertrees; 3 are vendored insidenpmitself. Directaxiosis already latest (1.19.0) and clean.Verification
app.jsloads;config,lib/mailer,lib/indexRetryall require clean.ejs3.1.10 /nodemailer9.0.5 /nconf0.13.0.views/*.ejscompile under ejs 3.1.10.masterhas no offline test suites — every suite undertests/needs a live APIand Solr, so there is no runnable regression gate here. The equivalent code on
alphaiscovered by Security dependency refresh + EBADENGINE cleanup: npm audit 106 -> 53 #191's 247-passing offline run, and the bumped deps and their usage sites are
identical between the branches.
No CLAUDE.md change
masterhas noCLAUDE.md— it's alpha-only. The Dependency Security Maintenance section(analysis, do-not-bump list, re-run procedure) is added in #191 and will arrive on
mastervia the normal
alpha→mastermerge. Omitted here on purpose to avoid a conflict.Stale dependabot PRs
#117, #118, #123, #124, #125, #126, #128, #129, #133 all target this branch, are all
CONFLICTING, and every package they name is already patched or superseded by this PR.Recommend closing them once this merges.
🤖 Generated with Claude Code