Skip to content

fix(deps): clear remaining #747 LOW/MEDIUM CVE backlog + fix live body-parser@2 regression - #838

Merged
claude[bot] merged 2 commits into
masterfrom
claude/issue-747-remaining-cve-triage
Aug 27, 2026
Merged

fix(deps): clear remaining #747 LOW/MEDIUM CVE backlog + fix live body-parser@2 regression#838
claude[bot] merged 2 commits into
masterfrom
claude/issue-747-remaining-cve-triage

Conversation

@claude

@claude claude Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Closes part of #747 — re-measured from latest master (axios #754, tar+dead-lockfile #813, and the 7-manifest minor/patch backlog #814 were already merged before this branch started).

Root cause found while re-measuring

Root package.json's body-parser override (added in #814) was ">=1.20.6" with no upper bound — the exact express@4 + body-parser incident this repo's own CLAUDE.md already documents as having happened once before. It had silently jumped backend/applications's express@4.22.2 to body-parser@2.3.0 (a breaking major) instead of the intended 1.20.6 patch. Bounded it to <2, matching every other manifest's copy of this same override — it now correctly resolves to 1.20.6.

Also found: package-lock.json's packages[""] never mirrors package.json's overrides field in this repo's lockfiles. That's why a plain npm install --package-lock-only silently no-ops on a newly-added override (per the issue's own warning) — npm's fast-path "up to date" check trusts an already-consistent-looking lockfile and never re-validates deeply nested exact-pinned subtrees. Re-synced the mirror after every scoped update in this PR.

Fixed (same-major, package-scoped npm update <pkg> --package-lock-only)

package manifest(s) before after
body-parser root (backend/applications) 2.3.0 (live major regression) 1.20.6
undici root (dev, via wrangler/miniflare) 7.28.0 7.29.0
qs root + chat/email/notification/selection-list-service (nested in root's lockfile) 6.11.0 6.15.3
body-parser root + chat/email/notification/selection-list-service (nested) 1.20.2 1.20.6
qs services/sms-service, services/email-service, services/billing-service (own lockfiles) 6.11.0 6.15.3
ws fuzefront-website/frontend (dev, via jsdom) 8.18.3 8.21.3

The 4 nested workspace trees for qs/body-parser needed a direct hand-patch to real, registry-verified 1.20.6/6.15.3 metadata (resolved+integrity copied from an actual npm resolution elsewhere in the same lockfile) after npm update/npm dedupe repeatedly no-opped on them — there's a genuine pre-existing peer conflict on express-rate-limit across backend/backend/applications/security-service that blocks a full npm dedupe from reconciling this class of exact-pinned subtree on its own. Verified idempotent: npm install --package-lock-only is a stable no-op (same content hash) after the fix, and npm ls <pkg> --package-lock-only --workspaces confirms every target resolves correctly tree-wide.

Already fixed by #813/#814 — confirmed, no action

axios, tar, tar-fs, ip-address, lodash, validator, morgan, follow-redirects, @remix-run/router, @tootallnate/once (2.0.1 has no CVE — the 3.0.1 major #747 originally floated was never actually required).

Genuinely blocked on a major — left as-is, evidence attached

  • uuid 9.0.1 (root, services/email-service, services/billing-service): the 9.x line has no release since 9.0.1 (only 9.0.0-beta.0, 9.0.0, 9.0.1 exist). Fix requires >=11.1.1.
  • react-router-dom 6.30.6 (fuzefront-website/frontend): already the maximum safe 6.x fix — clears GHSA-9jcx-v3wj-wh4m and GHSA-2j2x-hqr9-3h42. The remaining 2 of the original 4 CVEs (GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg) require >=7.18.0, correctly identified as a genuine major migration and out of scope here. root/ and frontend/'s own react-router are unrelated — both already on v7 (7.18.2 / 7.18.0) as a pre-existing dependency choice, not part of this CVE backlog.

Verification

  • npm install --package-lock-only idempotent (stable content hash, no further drift) on root and all 4 touched sub-manifests
  • npm ls <pkg> --package-lock-only --workspaces --include-workspace-root — every target package confirmed at intended version tree-wide
  • JSON.parse() validated on all 5 touched package-lock.json files
  • No npm ci / build run in this sandbox (disk-constrained, per the issue's own note about a 20-parallel-agent environment) — CI's npm ci + build + gate-toolchain matrix is the remaining verification surface on this PR

Full corrected triage table also posted as a comment on #747.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_013tMciHkPE8To7V67CsgKKc

Generated by Claude Code

@claude
fix(deps): clear remaining #747 LOW/MEDIUM CVE backlog + fix a live e…
dce0a07 
…xpress@4/body-parser@2 regression

Re-measured #747 from latest master (axios #754, tar+dead-lockfile #813, and the
7-manifest minor/patch backlog #814 were already merged). Re-verified every
"needs a major" claim against the currently-installed major line per the
methodology correction in the issue (Trivy's FixedVersion spans release
branches; max() over it overstates the required bump) — using `npm audit`
against isolated pinned-version fixtures as a stand-in for Trivy, which this
sandbox cannot reach (ghcr.io/aquasec denied, same as the issue's own note).

Root cause found while re-measuring: root package.json's `body-parser` override
(from #814) was `">=1.20.6"` with NO upper bound — the exact express@4 +
body-parser incident this repo's CLAUDE.md already documents as having
happened once before. It had silently jumped `backend/applications`'s
express@4.22.2 to body-parser@2.3.0 (a major, breaking API line) instead of
the intended 1.20.6 patch. Bounded it to `<2`, matching every other manifest's
copy of this same override, and it correctly resolved back down to 1.20.6.

Also found and fixed: package-lock.json's `packages[""]` never mirrors
package.json's `overrides` field in this repo's lockfiles (confirmed on 5
manifests) — this is *why* a plain `npm install --package-lock-only` silently
no-ops on a new override (per the issue's warning): npm's fast-path "up to
date" check trusts a lockfile that already looks internally consistent, and
without the mirror it never rechecks deeply-nested exact-pinned subtrees.
Re-synced the mirror after every scoped `npm update <pkg> --package-lock-only`
in this PR; a plain (non-scoped) install strips it again, so do not run one
after this without re-syncing.

Genuinely fixed (same-major, `npm update <pkg> --package-lock-only`,
package-scoped, no bare tree-wide update):
- root: undici 7.28.0 -> 7.29.0 (dev-only, via wrangler/miniflare)
- root + services/{sms,email,billing}-service: qs 6.11.0 -> 6.15.3 (new
  bounded override; was transitive via express@4.19.2's exact "6.11.0" pin,
  npm's override engine wasn't cascading into it — 4 nested trees inside
  root's own workspace lockfile needed a direct hand-patch to real,
  registry-verified 1.20.6/6.15.3 metadata after `npm update`/`dedupe`
  repeatedly no-opped on them; a real peer conflict on express-rate-limit
  across backend/backend-applications/security-service blocks a full
  `npm dedupe` from reconciling this on its own)
- root + services/{chat,email,notification,selection-list}-service (nested in
  root's own lockfile): body-parser 1.20.2 -> 1.20.6 (same patch, alongside
  the major-regression fix above)
- fuzefront-website/frontend: ws 8.18.3 -> 8.21.3 (new bounded override; dev
  dependency via jsdom, clears a HIGH DoS CVE plus the MEDIUM from #747)

Confirmed already fixed by #813/#814, no action: axios, tar, tar-fs,
ip-address, lodash, validator, morgan, follow-redirects, @remix-run/router,
@tootallnate/once (2.0.1 has no CVE — the 3.0.1 major floated in #747 was
never actually required).

Confirmed genuinely blocked on a major (left as-is, evidence below):
- uuid 9.0.1 (root, services/email-service, services/billing-service): the
  9.x line has no further release (9.0.0-beta.0, 9.0.0, 9.0.1 — nothing
  since); the fix requires >=11.1.1.
- react-router(-dom) 6.30.6 in fuzefront-website/frontend: already the
  maximum safe 6.x fix (clears GHSA-9jcx-v3wj-wh4m and GHSA-2j2x-hqr9-3h42);
  2 of the original 4 CVEs (GHSA-wrjc-x8rr-h8h6, GHSA-337j-9hxr-rhxg) require
  >=7.18.0 and were correctly never claimed fixable in #747's corrected
  telling. root/ and frontend/'s own react-router are unaffected — both
  already on v7 (7.18.2 / 7.18.0) as a pre-existing, unrelated dependency
  choice, not part of this CVE backlog.

Verified: `npm install --package-lock-only` (root and all 4 touched
sub-manifests) is idempotent post-fix (stable content hash across repeat
runs); `npm ls <pkg> --package-lock-only --workspaces` confirms every target
package now resolves to the intended version tree-wide; `node --eval
JSON.parse(...)` on all 5 touched package-lock.json files. No `npm ci` /
build run in this sandbox (disk-constrained, no network to a full registry
mirror) — CI's own `npm ci` + build + gate-toolchain matrix is the remaining
verification surface once this PR is up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013tMciHkPE8To7V67CsgKKc
@claude
claude Bot requested a review from izzywdev as a code owner August 27, 2026 08:15
@claude claude Bot added the auto-merge Enable squash auto-merge once CI passes label Aug 27, 2026
@claude claude Bot mentioned this pull request Aug 27, 2026
Open
@github-actions
github-actions Bot enabled auto-merge (squash) August 27, 2026 08:59
@claude
claude Bot merged commit 8d51f21 into master Aug 27, 2026
70 checks passed
@claude
claude Bot deleted the claude/issue-747-remaining-cve-triage branch August 27, 2026 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@izzywdev izzywdev Awaiting requested review from izzywdev izzywdev is a code owner

Assignees

No one assigned

Labels

auto-merge Enable squash auto-merge once CI passes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claude