Skip to content

[DEVPL-4096]fix:upgrade dependency to fix high vulnerability#335

Closed
ping-huang1 wants to merge 1 commit intomasterfrom
socket/dependency-fix-20260406
Closed

[DEVPL-4096]fix:upgrade dependency to fix high vulnerability#335
ping-huang1 wants to merge 1 commit intomasterfrom
socket/dependency-fix-20260406

Conversation

@ping-huang1
Copy link
Copy Markdown
Contributor

@ping-huang1 ping-huang1 commented Apr 6, 2026

fix: upgrade dependency to fix high vulnerability (GHSA-xjpj-3mr7-gcpf)

Summary

https://webflow.atlassian.net/browse/DEVPL-4096

Resolves a High severity JavaScript injection vulnerability in handlebars (GHSA-xjpj-3mr7-gcpf) using socket fix.

The Handlebars CLI precompiler unsafely concatenates user-controlled inputs (template names, --namespace, -c, -h flags) directly into generated JavaScript, allowing arbitrary code injection. CVSS Score: 8.2 (High)

Fix was computed via:

npx socket fix --id GHSA-xjpj-3mr7-gcpf

Package Changes

📄 package-lock.jsonnewly added

A package-lock.json was generated for the first time (6,871 lines), providing npm-based dependency resolution alongside the existing yarn.lock. All dependencies are resolved against the internal CodeArtifact registry.

🔒 yarn.lock — updated

Registry migration: All resolved URLs migrated from registry.yarnpkg.com → internal CodeArtifact mirror (intellimize-568976112162.d.codeartifact.us-west-2.amazonaws.com/npm/npm-store).

Packages removed (pruned from the dependency graph):

Package Removed Version
@biomejs/cli-darwin-x64 2.4.3
@biomejs/cli-linux-arm64 2.4.3
@biomejs/cli-linux-arm64-musl 2.4.3
@biomejs/cli-linux-x64 2.4.3
@biomejs/cli-linux-x64-musl 2.4.3
@biomejs/cli-win32-arm64 2.4.3
@biomejs/cli-win32-x64 2.4.3
@types/node (*) 25.5.0
undici-types (~7.18.0) 7.18.2

Packages restructured (entry splits/consolidations with no version change):

  • bn.js, hash-base, safe-buffer, semver, source-map-support, string_decoder — entries split per semver range for cleaner resolution

⚠️ Note

handlebars remains pinned at 4.7.8 (the vulnerable range is 4.0.0–4.7.8; fix is 4.7.9+). This is a transitive dependency of ts-jest via handlebars@^4.7.8. If the internal CodeArtifact registry does not carry 4.7.9, a manual override in package.json using overrides/resolutions may be needed to fully resolve the vulnerability.


Validation

  • ✅ Ran npm install — no errors
  • ✅ Lockfiles regenerated successfully

@ping-huang1 ping-huang1 changed the title fix:upgrade dependency to fix high vulnerability [DEVPL-4096]fix:upgrade dependency to fix high vulnerability Apr 6, 2026
@@ -4,7 +4,7 @@

"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.12.13", "@babel/code-frame@^7.28.6", "@babel/code-frame@^7.29.0":
version "7.29.0"
resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.29.0.tgz#7cd7a59f15b3cc0dcd803038f7792712a7d0b15c"
resolved "https://intellimize-568976112162.d.codeartifact.us-west-2.amazonaws.com/npm/npm-store/@babel/code-frame/-/code-frame-7.29.0.tgz"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ping-huang1 are these urls public and legit? we're changing these from registery.yarnpkg.com --> something internal with aws?

@ping-huang1 ping-huang1 closed this Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants