Repository navigation
fix(deps): stop shipping braces as a runtime dependency of the JS SDK - #36
Merged
Merged
Conversation
Addresses Dependabot alerts #175 and #176 (GHSA-vfj7-8cjw-p6xm, braces <= 3.0.3 stack-exhaustion DoS). No patched braces release exists (3.0.3 is the latest), so the package cannot be upgraded; instead this removes it from the SDK's runtime dependency graph. Files modified: - sdk/js/package.json: moved @babel/cli, jest, and msw from dependencies to devDependencies. They are build/test tools only (msw is imported only under test/, nothing in src/ imports any of them). They were the only runtime paths to braces (@babel/cli -> chokidar -> braces, jest -> micromatch -> braces), so consumers installing litegraphdb no longer pull braces. - sdk/js/package-lock.json: regenerated with npm install --package-lock-only; braces, chokidar, micromatch, jest, msw and their subtrees are now marked "dev": true. No package versions changed. Validation: npm ci + jest in sdk/js, 17 suites / 230 tests passed. Armada-Mission-Id: msn_muxq4e1v_XhSLY8WrNA5 Armada-Voyage-Id: vyg_muxq4e1s_hBYds24msTq Armada-Captain-Id: cpt_mutxrs2a_4g8cQVydfAH Armada-Vessel-Id: vsl_muu352c3_Vm6XWUxcI8h Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses Dependabot alerts #175 and #176 (GHSA-vfj7-8cjw-p6xm: braces <= 3.0.3, stack exhaustion from deeply nested brace patterns).
No patched version of braces exists (3.0.3 is the latest release), so the package cannot be bumped or overridden to a fixed version. This PR does what can be done:
sdk/js/package.json:@babel/cli,jest, andmswmove fromdependenciestodevDependencies. They are build/test tools only; nothing insrc/imports them. They were the only paths tobraces(@babel/cli -> chokidar@3 -> braces,jest -> micromatch -> braces), so anyone installinglitegraphdbno longer getsbracesat runtime.sdk/js/package-lock.json: regenerated. No versions changed; the affected subtrees are now marked"dev": true.Remaining exposure / follow-up
dashboarddepends on the publishedlitegraphdb@1.0.12from npm, and that version listsjestand@babel/clias runtime dependencies, sobracesstill shows up as runtime there. That clears once an SDK built from this change is published and the dashboard moves to it. The dashboard's ownjestandlint-stagedwould still pullbracesas a dev dependency (jest 29 and 30 both rely on micromatch 4).bracesis only used here by build/test tooling on developer-written glob patterns, never on untrusted input, so it is reasonable to dismiss them as "tolerable risk". I have not dismissed them.Test plan
npm ci+jestinsdk/js: 17 suites, 230 tests passed🤖 Generated with Claude Code