@microsoft/generator-sharepoint@1.24.0 installs 1.24.0-rc.0 packages; there are some vulnerabilities

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Linux

What browser(s) / client(s) have you tested

Additional environment details

browser version: N/A
SPFx version 1.24.0
Node.js version 26.13.0

Describe the bug / error

I followed install instructions of the page SharePoint Framework v1.24 release notes to scaffold a brand-new web part solution. I installed globally @microsoft/generator-sharepoint@1.24.0 and ran yo @microsoft/sharepoint. However:

the scaffolded solution had referenrences to the v. 1.24.0-rc.0 of the SharePoint packages
running npm audit, there were 11 vulnerabilities (7 low, 1 moderate, 3 high)

Then I upgraded all minor versions with npm-check-updates:

 @microsoft/eslint-config-spfx        1.24.0-rc.0  →  1.24.0
 @microsoft/eslint-plugin-spfx        1.24.0-rc.0  →  1.24.0
 @microsoft/sp-component-base         1.24.0-rc.0  →  1.24.0
 @microsoft/sp-core-library           1.24.0-rc.0  →  1.24.0
 @microsoft/sp-lodash-subset          1.24.0-rc.0  →  1.24.0
 @microsoft/sp-module-interfaces      1.24.0-rc.0  →  1.24.0
 @microsoft/sp-office-ui-fabric-core  1.24.0-rc.0  →  1.24.0
 @microsoft/sp-property-pane          1.24.0-rc.0  →  1.24.0
 @microsoft/sp-webpart-base           1.24.0-rc.0  →  1.24.0
 @microsoft/spfx-heft-plugins         1.24.0-rc.0  →  1.24.0
 @microsoft/spfx-web-build-rig        1.24.0-rc.0  →  1.24.0
 @rushstack/heft                            1.3.2  →   1.3.4
 css-loader                                ~7.1.2  →  ~7.1.5

but there were still 11 vulnerabilities. npm audit fix made things even a bit worse: 11 vulnerabilities (7 low, 4 high)

Steps to reproduce

See above

Expected behavior

@microsoft/generator-sharepoint@latest installs a release version, not an RC veresion
There are no vulnerabilities with the freshly installed packages.

Luc Mo Costabella (@lucmoco)

👋 Hi Luc Mo Costabella (@lucmoco),

Thank you for reporting this issue. Here is an AI-generated initial response:

Classification: Bug — The reported fresh scaffold from @microsoft/generator-sharepoint@1.24.0 references 1.24.0-rc.0 packages, contrary to the 1.24 GA guidance to use aligned 1.24.0 packages. The generator defect is suspected, not independently confirmed.

Node.js 26.13.0 is supported for SPFx 1.24. The 11 audit findings persisted after the reporter changed package versions, so they need separate investigation; an audit count alone does not establish exploitability. Audit guidance

Upgrade check: The reporter is already using the documented 1.24.0 GA generator. No applicable fixing release is identified.

What to do now:

In a fresh scaffold, capture package.json, the lockfile, and the generator version to confirm which references are RC.
Align SPFx package references to 1.24.0, update the lockfile, and validate the build. Avoid blanket updates or an unreviewed npm audit fix.
Share the full audit advisories and dependency paths to assess the remaining findings.

Useful links:

SPFx package-update guidance
sp-dev-docs#10648 — Earlier SPFx npm-audit findings — related historically, not confirmation of these 11 findings.

Note: AI-generated guidance may be incomplete or incorrect. Please verify suggestions before applying them.

Here is my package.json after upgrading minor versions:

{
  "name": "spfx-versions",
  "version": "0.0.1",
  "private": true,
  "engines": {
    "node": ">=22.14.0 <23.0.0 || >=24.0.0 <25.0.0 || >=26.0.0 <27.0.0"
  },
  "scripts": {
    "build": "heft test --clean --production && heft package-solution --production",
    "clean": "heft clean",
    "eject-webpack": "heft eject-webpack",
    "start": "heft start --clean"
  },
  "dependencies": {
    "tslib": "2.3.1",
    "react": "18.3.1",
    "react-dom": "18.3.1",
    "@fluentui/react": "^8.106.4",
    "@microsoft/sp-core-library": "1.24.0",
    "@microsoft/sp-component-base": "1.24.0",
    "@microsoft/sp-property-pane": "1.24.0",
    "@microsoft/sp-webpart-base": "1.24.0",
    "@microsoft/sp-lodash-subset": "1.24.0",
    "@microsoft/sp-office-ui-fabric-core": "1.24.0"
  },
  "devDependencies": {
    "@microsoft/eslint-plugin-spfx": "1.24.0",
    "@microsoft/eslint-config-spfx": "1.24.0",
    "@microsoft/spfx-web-build-rig": "1.24.0",
    "@microsoft/spfx-heft-plugins": "1.24.0",
    "@rushstack/heft": "1.3.4",
    "@types/jest": "30.0.0",
    "@types/webpack-env": "~1.15.2",
    "css-loader": "~7.1.5",
    "eslint": "9.37.0",
    "typescript": "~5.8.0",
    "@types/react": "18.2.79",
    "@types/react-dom": "18.2.25",
    "eslint-plugin-react-hooks": "5.2.0",
    "@microsoft/sp-module-interfaces": "1.24.0"
  },
  "overrides": {
    "@rushstack/heft": "1.3.4",
    "qs": ">=6.15.2",
    "uuid": ">=11.1.1"
  },
  "resolutions": {
    "@types/react": "18.2.79"
  }
}

I've deleted package-lock.json and the node_modules folder and reinstalled all packages. Here is the output of npm audit:

# npm audit report

@hono/node-server  1.19.10 - 2.1.2
Severity: moderate
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths - https://github.com/advisories/GHSA-rmxm-3fg6-px4f
fix available via `npm audit fix`
node_modules/@hono/node-server

@modelcontextprotocol/sdk  <=1.31.0
Severity: high
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server - https://github.com/advisories/GHSA-6qxp-vccf-f47h
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them - https://github.com/advisories/GHSA-22jm-h49p-29qw
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies - https://github.com/advisories/GHSA-6prh-2h8m-c8cw
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation - https://github.com/advisories/GHSA-46jr-4wx8-v453
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service - https://github.com/advisories/GHSA-rvq5-wwqv-78pq
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length - https://github.com/advisories/GHSA-f897-62hf-6gxq
fix available via `npm audit fix --force`
Will install @microsoft/spfx-heft-plugins@1.23.2, which is a breaking change
node_modules/@modelcontextprotocol/sdk
  @microsoft/spfx-heft-plugins  >=1.20.0
  Depends on vulnerable versions of @modelcontextprotocol/sdk
  Depends on vulnerable versions of @rushstack/module-minifier
  Depends on vulnerable versions of @rushstack/webpack5-module-minifier-plugin
  node_modules/@microsoft/spfx-heft-plugins
    @microsoft/spfx-web-build-rig  >=1.15.0-beta.1
    Depends on vulnerable versions of @microsoft/spfx-heft-plugins
    Depends on vulnerable versions of @rushstack/heft-jest-plugin
    node_modules/@microsoft/spfx-web-build-rig

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install @microsoft/spfx-web-build-rig@1.23.2, which is a breaking change
node_modules/deepmerge
  jest-config  >=25.2.0-alpha.86
  Depends on vulnerable versions of deepmerge
  node_modules/jest-config
    @jest/core  >=25.2.0-alpha.86
    Depends on vulnerable versions of jest-config
    node_modules/@jest/core
      @rushstack/heft-jest-plugin  >=0.1.1
      Depends on vulnerable versions of @jest/core
      Depends on vulnerable versions of jest-config
      node_modules/@rushstack/heft-jest-plugin

serialize-javascript  <7.1.3
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body - https://github.com/advisories/GHSA-m5mm-p8h7-m29v
fix available via `npm audit fix --force`
Will install @microsoft/spfx-heft-plugins@1.23.2, which is a breaking change
node_modules/serialize-javascript
  @rushstack/module-minifier  *
  Depends on vulnerable versions of serialize-javascript
  node_modules/@rushstack/module-minifier
    @rushstack/webpack5-module-minifier-plugin  *
    Depends on vulnerable versions of @rushstack/module-minifier
    node_modules/@rushstack/webpack5-module-minifier-plugin

11 vulnerabilities (7 low, 1 moderate, 3 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Luc Mo Costabella (@lucmoco)

thx Luc Mo Costabella (@lucmoco) for reporting this issue. I can repro this as well and we have started the needed work to provide fixes for the 1.24 RC package references.

On the vulnerabilities - we try to always keep up to date on them and do address any client-side critical issues as soon as possible. Common root cause for these is the developer time environment, so the reported issues are NOT packaged or SPFx solutions which are deployed and used in the SharePoint Online. So issues which are server related are not valid for the SPFx usage scenarios, but it's still confusing for the developers.

Our engineering team is looking into these and will have an update asap.

Vesa Juvonen (@VesaJuvonen)

Thank you for your quick answer and actions Vesa Juvonen (@VesaJuvonen).

As I already emphasized in another issue, dev dependency vulnerabilities are also important to fix. In the worst case a compromised dev dependency could be used to steal our passwords and secrets in the CI/CD deployment pipeline, or do some high-privilege operations. So in my team we have set up a nightly security check and we try to fix all securities, including dev dependencies, as soon as possible. And sometimes it's hard or not possible with SPFx packages when there has not been a release for a long time, that's why we appreciate the stance to release SPFx versions on a regular basis with fixed vulnerabilities.

Luc Mo Costabella (@lucmoco)

thx Luc Mo Costabella (@lucmoco) on the additional comments. Initial fix for RC0 packages is rolling out today with 1.24.1. You can do that update manually as needed.

1.24.1 will also address some of the vulnerabilities - and we will keep on working through them. It's a moving goal with daily updates.

Document SPFx 1.24.1 maintenance release

We just rolled out 1.24.1 build - but as expected - situation with the vulnerabilities changes each and every day - this is the norm currently.

Current situation for baseline web part as follows - it's a moving target which is getting addressed as it's possible. These are on the server side build process - serving the local builds - that's not an attack vector for CD/CI pipelines. Still not a great situation and shows the current status of the ecosystem with the packages with constantly moving target.

Navigation Menu

Repository navigation

@microsoft/generator-sharepoint@1.24.0 installs 1.24.0-rc.0 packages; there are some vulnerabilities #11078

Target SharePoint environment

What SharePoint development model, framework, SDK or API is this about?

Developer environment

What browser(s) / client(s) have you tested

Additional environment details

Describe the bug / error

Steps to reproduce

Expected behavior

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

@microsoft/generator-sharepoint@1.24.0 installs 1.24.0-rc.0 packages; there are some vulnerabilities #11078

Description

Target SharePoint environment

What SharePoint development model, framework, SDK or API is this about?

Developer environment

What browser(s) / client(s) have you tested

Additional environment details

Describe the bug / error

Steps to reproduce

Expected behavior

Activity

m365-agent-toolkit-assistant commented on Oct 29, 2026

lucmoco commented on Oct 29, 2026

VesaJuvonen commented on Oct 29, 2026

lucmoco commented on Oct 30, 2026

VesaJuvonen commented on Nov 2, 2026

VesaJuvonen commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions