Repository navigation
Conversation
…erable tar chain sqlite3@5 pulled node-gyp@8 / cacache and tar@6.2.1 (critical advisory, tar <= 7.5.20) into every project generated by projects:create:demo. sqlite3@6 depends on tar ^7.5.10 and no longer needs that chain. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes PRD-1860
Problem
A fresh
npm installof a project generated byforest projects:create:demoreported 15 vulnerabilities (2 low, 4 moderate, 8 high, 1 critical). The critical one istar<= 7.5.20, reached through@forestadmin/datasource-demo-fintech→sqlite3@5.1.7→node-gyp@8.4.1/cacache→tar@6.2.1.Change
Bump
sqlite3from^5.1.7to^6.0.1indatasource-demo-fintech(workflow-executoralready uses it).yarn.lockis unchanged: thesqlite3@^6.0.1entry already exists.datasource-sqlhas no sqlite3 dependency, so it does not pull this chain.Verification
@forestadmin/agent@^1, the packed tarball of this branch,@forestadmin/workflow-executor@^1,dotenv@^16:npm auditreports 8 vulnerabilities (5 moderate, 3 high), 0 critical. Remaining ones arezod/uuid/sequelize(PRD-1861). Resolved tree:sqlite3@6.0.1→tar@7.5.22,node-gyp@12.4.0.createDemoFintechDataSource()boots on macOS arm64 (sqlite3 prebuilt binary) and lists rows from all 8 collections.yarn workspace @forestadmin/datasource-demo-fintech test: 2/2 pass.Out of scope:
zod,uuid,sequelize(PRD-1861).🤖 Generated with Claude Code
Note
Bump
sqlite3to ^6.0.1 indatasource-demo-fintechto drop vulnerable tar chainUpdates the
sqlite3dependency range from^5.1.7to^6.0.1in package.json. Risk:sqlite36.x is a major version bump; check for breaking API changes before merging.Macroscope summarized 090f2b9.