Skip to content

chore(deps): bump vm2 and @dataform/cli - #353

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-30a86ea74f
Sep 1, 2026
Merged

chore(deps): bump vm2 and @dataform/cli#353
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-30a86ea74f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps vm2 to 3.11.6 and updates ancestor dependency @dataform/cli. These dependencies need to be updated together.

Updates vm2 from 3.11.4 to 3.11.6

Release notes

Sourced from vm2's releases.

v3.11.6

Five advisories closed. Patch release — no API changes for valid configurations.

What's Changed

Security fixes

  • GHSA-cfcw-xp6x-25gj — Stacked-indirection bypass of the GHSA-v6mx-mf47-r5wg apply-trap peel. Two layers of Function.prototype.{call,apply,bind} pushed the host prototype mutator out of the inspected position; a later variant ran the __proto__ setter entirely host-side, defeating both identity checks (RCE).
  • GHSA-gmc2-2x9w-cgh9 — bufferAllocLimit bypass via Buffer.concat(list, totalLength) and Buffer.from(arrayLike), which reach the host allocator without traversing the sandbox-side wrapper — one call allocates past a configured cap (host memory-exhaustion DoS).
  • GHSA-m283-3h24-438v — Host errors leaked live host references into sandbox catch blocks via Error.cause, the SuppressedError / AggregateError slots, arbitrary own properties (err.detail = process), and the carrier's prototype chain. Any embedder function throwing an error that carried a host reference was an escape (RCE).
  • GHSA-m5w8-4gq2-6f8x — NodeVM builtin: ['*'] exposed os and dns, the last two process-wide builtins. Both leak host identity and network topology, and both write host state: dns.setServers() hijacks the host's DNS resolver, os.setPriority() renices the host process.
  • GHSA-v836-6xw4-9cx3 — bufferAllocLimit bypass via ArrayBuffer, SharedArrayBuffer, every TypedArray constructor, and WebAssembly.Memory, which hit the same timeout-immune V8 allocator uncapped — a ~200-byte payload becomes gigabytes of host RSS (host memory-exhaustion DoS).

Upgrade Notes

  • builtin: ['*'] users depending on os or dns — both are now denied, along with node:os, node:dns and dns/promises. Re-introduce a safe subset via require.mock / require.override.
  • Finite bufferAllocLimit users — the cap now also covers Buffer.concat / from / copyBytesFrom and the ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory constructors. The default Infinity is unaffected.
  • Host errors now reach sandbox catch blocks as sandbox-realm errors. Primitive diagnostics are preserved and instanceof now works for subclasses; non-primitive properties and the host prototype chain are gone by design.

Full Changelog: patriksimek/vm2@v3.11.5...3.11.6

v3.11.5

What's Changed

Bug fixes

  • #566 — Restore util.inspect output on Node 26+. console.log(vm.run(...)) was rendering as Proxy(Proxy({})) / Proxy(Proxy([])) instead of the underlying value. Triggered by Node 26's stricter handling of nested proxies in the inspector.
  • #567 — Restore array iteration on vm.freeze()'d host arrays. Calling .map() / .filter() / .forEach() etc. inside the sandbox on a frozen host object containing arrays threw TypeError: 'isExtensible' on proxy: trap result does not reflect extensibility of proxy target. Regression from the 3.11.0 proxy-invariant hardening.
  • #568 — Fix .node extension handler key in lib/resolver.js (the key was ' .node' with a leading space, so native addon resolution silently fell through to the default path). Thanks to @​cherr-cc.

Upgrade Notes

Drop-in replacement for 3.11.4. No API or configuration changes.

Full Changelog: patriksimek/vm2@v3.11.4...v3.11.5

Changelog

Sourced from vm2's changelog.

[3.11.6]

Five advisories closed. Patch release — no API changes for valid configurations.

Security fixes

  • GHSA-cfcw-xp6x-25gj — stacked-indirection bypass of the GHSA-v6mx-mf47-r5wg apply-trap peel: the peel inspected one layer of Function.prototype.{call,apply,bind} indirection, so two layers slipped the host prototype mutator past it, and a follow-up variant laundered the severance entirely host-side. Closed at two independent chokepoints — lib/bridge.js refuses to deliver host prototype mutators, and both it and handleException reject any host object whose prototype chain reaches null without passing through the sandbox Object.prototype. See ATTACKS.md Category 37 and test/ghsa/GHSA-cfcw-xp6x-25gj/.
  • GHSA-gmc2-2x9w-cgh9 — bufferAllocLimit (GHSA-6785-pvv7-mvg7) bypass via Buffer.concat(list, totalLength) and Buffer.from(arrayLike), whose host implementations reach the C++ allocator without traversing the sandbox-side allocUnsafe wrapper. lib/setup-sandbox.js now caps concat, from, and copyBytesFrom, and a fail-closed enumeration of host.Buffer's own keys turns any future uncapped allocator into an explicit error rather than a silent bypass. See ATTACKS.md Category 23 (extended) and test/ghsa/GHSA-gmc2-2x9w-cgh9/.
  • GHSA-m283-3h24-438v — host errors leaked live host references into sandbox catch blocks through four channels: Error.cause, the SuppressedError / AggregateError sub-error slots, arbitrary own properties (err.detail = process), and — beyond the reach of own-key enumeration — the carrier's own prototype chain. handleException now seals the spec-defined slots and rebuilds every host-wrapped carrier as a fresh sandbox-realm error carrying only its primitive properties, discarding the host prototype chain entirely. See ATTACKS.md Category 38 and test/ghsa/GHSA-m283-3h24-438v/.
  • GHSA-m5w8-4gq2-6f8x — sibling of GHSA-9g8x: NodeVM builtin: ['*'] still surfaced os and dns, the last two process-wide builtins. Beyond host-identity and network-topology reads, both carry writes reachable in one line of sandbox code — dns.setServers() hijacks the host's DNS resolver, os.setPriority() renices the host process. lib/builtin.js adds both to DANGEROUS_BUILTINS, covering node: spellings and dns/promises automatically. See ATTACKS.md Category 35 (extended) and test/ghsa/GHSA-m5w8-4gq2-6f8x/.
  • GHSA-v836-6xw4-9cx3 — bufferAllocLimit bypass via ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory, which reach the same synchronous, timeout-immune V8 backing-store allocator uncapped. When a finite limit is set, lib/setup-sandbox.js wraps each constructor with a construct trap capping the ToIndex-coerced byte count, and pins prototype.constructor so the uncapped intrinsic cannot be recovered by a constructor walk. The default Infinity leaves them untouched. See ATTACKS.md Category 36 and test/ghsa/GHSA-v836-6xw4-9cx3/.

Upgrade notes

  • If you use NodeVM({ require: { builtin: ['*'] } }) and depend on os or dns, those two builtins are now denied (GHSA-m5w8-4gq2-6f8x), together with node:os, node:dns, and dns/promises. They join the process-wide class closed in 3.11.4: they expose host-process identity and network topology, and dns.setServers() / dns.setDefaultResultOrder() / os.setPriority() are outright writes to host-process state. Embedders needing a sandbox-local subset (typically os.platform(), os.EOL, os.constants) should register a controlled wrapper via require.mock or require.override.
  • If you set a finite bufferAllocLimit, the cap now also covers Buffer.concat, Buffer.from, Buffer.copyBytesFrom, and the ArrayBuffer / SharedArrayBuffer / TypedArray / WebAssembly.Memory constructors (GHSA-gmc2-2x9w-cgh9, GHSA-v836-6xw4-9cx3). Sandbox code that previously allocated past the cap through those paths now gets the same RangeError. The default bufferAllocLimit: Infinity leaves every one of them untouched, so this is a no-op unless you opted into the cap.
  • Errors thrown by embedder-exposed host functions now reach sandbox catch blocks as sandbox-realm errors rather than proxies of the host error (GHSA-m283-3h24-438v). Primitive diagnostics (message, name, stack, code, errno, syscall, path, …) are preserved and error subclasses (TypeError, RangeError, …) now satisfy instanceof correctly inside the sandbox; non-primitive properties, and anything reachable through the error's prototype chain, are gone by design.

[3.11.5]

Patch release — no API changes.

Fix

  • #566 — util.inspect of vm.run(...) results rendered as Proxy(Proxy({})) on Node 26+. Install nodejs.util.inspect.custom on host-side proxy targets so the inspect output reflects the underlying shape.
  • #567 — Array iteration methods on a vm.freeze()-d host array threw an 'isExtensible' on proxy invariant error (regression from the GHSA-grj5-jjm8-h35p species defense). Align the ReadOnly proxy target's extensibility with its trap result and skip species neutralization on the host→sandbox apply path.
Commits

Updates @dataform/cli from 3.0.64 to 3.0.67

Release notes

Sourced from @​dataform/cli's releases.

3.0.67

What's Changed

Full Changelog: dataform-co/dataform@3.0.66...3.0.67

3.0.66

What's Changed

New Contributors

Full Changelog: dataform-co/dataform@3.0.65...3.0.66

3.0.65

What's Changed

Full Changelog: dataform-co/dataform@3.0.64...3.0.65

Commits
  • a216942 Update the npm package version (#2265)
  • 19a81ff Fix LegacyConfigConverter mutating caller-shared configs (#2260)
  • 1da401e test(lineage): cover multi-task errorMessage aggregation (#2263)
  • ef97135 feat(lineage): skip emission on UNAUTHENTICATED like PERMISSION_DENIED (#2264)
  • a440b22 test(lineage): add positive emit test for operation-type actions (#2262)
  • c1cad40 feat(lineage): add DATAFORM_LINEAGE_DEBUG env var (#2261)
  • 0476886 feat(lineage): harden CLI lineage emission (endpoint routing, retry, structur...
  • 30eaf1c Bump DF_VERSION from 3.0.65 to 3.0.66 (#2257)
  • f6d81b1 feat(lineage): emit GCP-oriented OpenLineage facets for Knowledge Catalog UI ...
  • b5a1435 Wire PropertyGraph into CLI build and DDL execution (#2255)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump vm2 and @dataform/cli
ca3c587 
Bumps [vm2](https://github.com/patriksimek/vm2) to 3.11.6 and updates ancestor dependency [@dataform/cli](https://github.com/dataform-co/dataform). These dependencies need to be updated together.


Updates `vm2` from 3.11.4 to 3.11.6
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md)
- [Commits](patriksimek/vm2@v3.11.4...3.11.6)

Updates `@dataform/cli` from 3.0.64 to 3.0.67
- [Release notes](https://github.com/dataform-co/dataform/releases)
- [Commits](dataform-co/dataform@3.0.64...3.0.67)

---
updated-dependencies:
- dependency-name: vm2
  dependency-version: 3.11.6
  dependency-type: indirect
- dependency-name: "@dataform/cli"
  dependency-version: 3.0.67
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@github-actions
github-actions Bot merged commit a38083f into main Sep 1, 2026
3 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/multi-30a86ea74f branch September 1, 2026 10:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants