fix(security): bump vite/vitest/esbuild to clear all Medium+ CVEs by seonghobae · Pull Request #5 · ContextualWisdomLab/inkspan

seonghobae · 2026-07-08T10:58:48Z

What

Bumps dev-tooling on the default branch (shared base — feature branches inherit) to clear every Medium-and-above advisory that osv-scan / trivy-fs / pnpm audit flag against pnpm-lock.yaml.

Severity	Package	Advisory	Vulnerable	Fixed
CRITICAL	vitest	GHSA-5xrq-8626-4rwp (UI server arbitrary file read/exec)	`<3.2.6`	`3.2.7`
HIGH	vite	GHSA-fx2h-pf6j-xcff (`server.fs.deny` bypass on Windows)	`<=6.4.2`	`6.4.3`
MODERATE	vite	GHSA-4w7w-66w2-5vf9 (path traversal in optimized deps `.map`)	`<=6.4.1`	`6.4.3`
MODERATE	vite	GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure)	`<=6.4.2`	`6.4.3`
MODERATE	esbuild	GHSA-67mh-4wv8-2f99 (dev-server request forgery)	`<=0.24.2`	`0.25.12`

How

vite ^5.4.11 → ^6.4.3, vitest ^2.1.8 → ^3.2.6, @vitest/coverage-v8 ^2.1.8 → ^3.2.6.
vitest/vite-node still resolve a transitive vite@5, so a pnpm-workspace overrides block pins vite ^6.4.3 / esbuild ^0.25 across the whole tree (this repo is a pnpm workspace — pnpm 10+ reads overrides from pnpm-workspace.yaml, not package.json).
Added @types/node explicitly — it was only present transitively under the old vite 5 subtree, and tsconfig.json's types: ["vitest/globals", "node"] requires it.

Verification (grounded)

pnpm audit --audit-level=low → No known vulnerabilities found
osv-scanner scan --lockfile=pnpm-lock.yaml → No issues found
pnpm typecheck ✓ · pnpm test (45 tests) ✓ · pnpm build ✓ · pnpm build:demo ✓
All bumped packages are MIT-licensed (permissive).

🤖 Generated with Claude Code

Resolves all Medium+ advisories flagged by osv-scan / trivy-fs / pnpm audit on the shared base: - vitest <3.2.6 CRITICAL GHSA-5xrq-8626-4rwp (UI server arbitrary file read/exec) -> 3.2.7 - vite <=6.4.2 HIGH GHSA-fx2h-pf6j-xcff (server.fs.deny bypass, Windows) -> 6.4.3 - vite <=6.4.1 MODERATE GHSA-4w7w-66w2-5vf9 (path traversal in optimized deps) -> 6.4.3 - vite <=6.4.2 MODERATE GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclose) -> 6.4.3 - esbuild <=0.24.2 MODERATE GHSA-67mh-4wv8-2f99 (dev server request forgery) -> 0.25.12 vitest/vite-node otherwise resolve a transitive vite@5, so a pnpm-workspace override pins vite ^6.4.3 / esbuild ^0.25 across the whole tree. Added @types/node explicitly (was only transitively present under the old vite 5 subtree; the tsconfig "types" array requires it). Verified: pnpm audit and osv-scanner both clean; typecheck, 45 tests, build and build:demo all pass. All bumped packages are MIT-licensed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P

github-advanced-security · 2026-07-08T18:19:30Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

CI pins pnpm 9 (.github/workflows/ci.yml, pnpm/action-setup version: 9). pnpm 9 does not read the overrides / onlyBuiltDependencies keys from pnpm-workspace.yaml (that is pnpm 10+ syntax), so it computed an empty overrides set while pnpm-lock.yaml still recorded the vite/esbuild overrides. That mismatch failed pnpm install --frozen-lockfile with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, breaking build-and-test and the dependent coverage-evidence gate. Move the security overrides and build-approval settings to package.json under the pnpm key, where pnpm 9 reads them. The lockfile is unchanged (it already pins esbuild 0.25.12 and vite 6.4.3), so the patched-version security posture is preserved while frozen install, tests (45 passing), and coverage now succeed.

seonghobae · 2026-07-09T11:47:56Z

Updated PR #5 at 926ade86d0ac90ea67034269f07558807910dec5 after reading the failing coverage/SARIF/code-scanning evidence.

What changed:

Moved CodeQL security-events: write from top-level workflow permissions to the CodeQL job, keeping top-level contents: read for Scorecard Token-Permissions.
Strengthened SECURITY.md with an explicit GitHub Security Advisory reporting URL so the Medium SecurityPolicyID alert has a concrete private report channel.
Added a .clusterfuzzlite/Dockerfile HEALTHCHECK for Trivy DS-0026 and made the Dockerfile emit a clear ::error if a runner builds it with the Dockerfile directory instead of the repository root context.
Pinned project package-manager behavior to pnpm@10.34.4, moved patched vite/esbuild overrides plus allowBuilds.esbuild into pnpm-workspace.yaml, and removed the ignored package.json#pnpm block that caused the coverage log's ERR_PNPM_LOCKFILE_CONFIG_MISMATCH / ignored esbuild build-script failure.
Removed the root Dockerfile's non-frozen install fallback so lockfile/config drift fails visibly instead of being papered over.

Verification run locally:

pnpm install --frozen-lockfile (pnpm 10.34.4) PASS; esbuild postinstall ran after explicit approval.
pnpm typecheck PASS.
pnpm test PASS: 45 tests.
pnpm build PASS.
pnpm build:demo PASS.
pnpm audit --audit-level=moderate PASS: no known vulnerabilities.
OSV scanner v2.4.0 on pnpm-lock.yaml PASS: no issues found.
workflow YAML parse PASS.
git diff --check PASS.
CodeGraph sync/status PASS.

Local Docker daemon is unavailable in this Windows workspace (//./pipe/docker_engine missing), so the actual Docker build remains delegated to GitHub Actions. The new head checks are currently queued, and the old GHAS TokenPermissions review thread is already outdated; waiting on the new Security Scan SARIF to retire the remaining old DS-0026/SecurityPolicy alerts.

seonghobae · 2026-07-11T12:53:27Z

Closing as superseded by #6 (merged as bfd6963). #6 landed the same dependency-CVE remediation this PR proposed — vite ≥6.4.3, vitest/@vitest/coverage-v8 ≥3.2.6, esbuild fixed, with the overrides moved to pnpm-workspace.yaml (modern pnpm ignores the package.json pnpm.overrides field, which is what caused this branch's ERR_PNPM_LOCKFILE_CONFIG_MISMATCH) — plus 100% coverage and the DS-0002 root-Dockerfile hardening. pnpm-lock.yaml on main no longer resolves any vulnerable vite@5/esbuild@0.21. This branch is now DIRTY against the updated main; no rebase needed since the fix is already merged.

Generated by Claude Code

seonghobae and others added 2 commits July 9, 2026 11:34

fix(security): harden inkspan ci and container gates

e4da95e

github-advanced-security Bot found potential problems Jul 9, 2026

View reviewed changes

Comment thread .github/workflows/codeql.yml Fixed

github-advanced-security Bot found potential problems Jul 9, 2026

View reviewed changes

Comment thread .clusterfuzzlite/Dockerfile Fixed

fix(ci): repair pnpm security gates

926ade8

seonghobae mentioned this pull request Jul 11, 2026

fix(security): clear vite/vitest/esbuild CVEs and unblock coverage-evidence #6

Merged

seonghobae closed this Jul 11, 2026

Navigation Menu

Repository navigation

fix(security): bump vite/vitest/esbuild to clear all Medium+ CVEs - #5

fix(security): bump vite/vitest/esbuild to clear all Medium+ CVEs#5
seonghobae wants to merge 4 commits into
mainfrom
fix/security-deps-bump

seonghobae commented Jul 8, 2026

Uh oh!

github-advanced-security AI commented Jul 8, 2026

Uh oh!

Uh oh!

Uh oh!

seonghobae commented Jul 9, 2026

Uh oh!

seonghobae commented Jul 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

seonghobae commented Jul 8, 2026

What

How

Verification (grounded)

Uh oh!

github-advanced-security AI commented Jul 8, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Uh oh!

seonghobae commented Jul 9, 2026

Uh oh!

seonghobae commented Jul 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants