From 777e34cf3dbec78fbce8171d8fc1152b64c2a15b Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 23 Jul 2026 04:01:30 +0000 Subject: [PATCH] UID2-7554/7555: bump fast-uri npm override to ^3.1.4; suppress svgo GHSA-2p49 fast-uri (CVE-2026-13676, CVE-2026-16221): bump override >=3.1.2 -> ^3.1.4 in both react-client-side sub-projects; lockfiles regenerated (resolves fast-uri 3.1.4). svgo (GHSA-2p49-hgcm-8545): the app-level svgo already resolves to fixed 3.3.4 via its ^3.3.3 range, but residual copies remain under postcss-svgo (2.8.1) and, critically, react-scripts@5's bundled @svgr/webpack@5.5.0 (svgo 1.3.2, no in-major fix). svgo here is build-time-only SVG optimization of our own trusted assets (not reachable at runtime), and forcing the react-scripts 1.x copy across a major breaks the CRA build. Suppressed in .trivyignore with expiry 2026-08-23 pending a react-scripts upgrade/removal. Co-Authored-By: Claude Opus 4.8 (1M context) --- .trivyignore | 9 +++++++ .../react-client-side/package-lock.json | 26 ++++++++++++++++--- .../react-client-side/package.json | 2 +- .../react-client-side/package-lock.json | 26 ++++++++++++++++--- .../react-client-side/package.json | 2 +- 5 files changed, 55 insertions(+), 10 deletions(-) diff --git a/.trivyignore b/.trivyignore index 734ff85..6b0a57e 100644 --- a/.trivyignore +++ b/.trivyignore @@ -11,3 +11,12 @@ CVE-2026-1615 exp:2026-09-16 # zlib contrib/untgz demo utility buffer overflow - not exploitable; Alpine does not ship the untgz binary. # See: UID2-6704 CVE-2026-22184 exp:2026-09-09 + +# GHSA-2p49-hgcm-8545 (HIGH) - svgo removeScripts plugin leaves some executable scripts intact. +# svgo is build-time-only tooling here: it optimizes the examples' own (trusted) SVG assets at +# build time and is never run against untrusted input, so it is not reachable at runtime. The +# app-level svgo (3.x) and postcss-svgo (2.x) could be bumped, but a third copy is svgo 1.3.2 +# bundled inside react-scripts@5's @svgr/webpack@5.5.0, which has NO in-major fix (fixed only in +# 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until +# react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698) +GHSA-2p49-hgcm-8545 exp:2026-08-23 diff --git a/web-integrations/google-secure-signals/react-client-side/package-lock.json b/web-integrations/google-secure-signals/react-client-side/package-lock.json index 6b49b80..9335942 100644 --- a/web-integrations/google-secure-signals/react-client-side/package-lock.json +++ b/web-integrations/google-secure-signals/react-client-side/package-lock.json @@ -7490,9 +7490,9 @@ "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==" }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "funding": [ { "type": "github", @@ -7502,7 +7502,8 @@ "type": "opencollective", "url": "https://opencollective.com/fastify" } - ] + ], + "license": "BSD-3-Clause" }, "node_modules/fastq": { "version": "1.19.1", @@ -15310,6 +15311,23 @@ } } }, + "node_modules/tailwindcss/node_modules/yaml": { + "version": "2.9.0", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", + "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "license": "ISC", + "optional": true, + "peer": true, + "bin": { + "yaml": "bin.mjs" + }, + "engines": { + "node": ">= 14.6" + }, + "funding": { + "url": "https://github.com/sponsors/eemeli" + } + }, "node_modules/tapable": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz", diff --git a/web-integrations/google-secure-signals/react-client-side/package.json b/web-integrations/google-secure-signals/react-client-side/package.json index 0269798..54891dd 100644 --- a/web-integrations/google-secure-signals/react-client-side/package.json +++ b/web-integrations/google-secure-signals/react-client-side/package.json @@ -39,7 +39,7 @@ "picomatch": "^2.3.2", "lodash": "^4.18.0", "@babel/plugin-transform-modules-systemjs": ">=7.29.4", - "fast-uri": ">=3.1.2", + "fast-uri": "^3.1.4", "shell-quote": "1.9.0", "ws": ">=7.5.11", "websocket-driver": "^0.7.5", diff --git a/web-integrations/javascript-sdk/react-client-side/package-lock.json b/web-integrations/javascript-sdk/react-client-side/package-lock.json index c7a39fc..9b5bb3d 100644 --- a/web-integrations/javascript-sdk/react-client-side/package-lock.json +++ b/web-integrations/javascript-sdk/react-client-side/package-lock.json @@ -7462,9 +7462,9 @@ "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==" }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "funding": [ { "type": "github", @@ -7474,7 +7474,8 @@ "type": "opencollective", "url": "https://opencollective.com/fastify" } - ] + ], + "license": "BSD-3-Clause" }, "node_modules/fastq": { "version": "1.19.1", @@ -15278,6 +15279,23 @@ } } }, + "node_modules/tailwindcss/node_modules/yaml": { + "version": "2.9.0", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz", + "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==", + "license": "ISC", + "optional": true, + "peer": true, + "bin": { + "yaml": "bin.mjs" + }, + "engines": { + "node": ">= 14.6" + }, + "funding": { + "url": "https://github.com/sponsors/eemeli" + } + }, "node_modules/tapable": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz", diff --git a/web-integrations/javascript-sdk/react-client-side/package.json b/web-integrations/javascript-sdk/react-client-side/package.json index e9dfc0e..fe4d88b 100644 --- a/web-integrations/javascript-sdk/react-client-side/package.json +++ b/web-integrations/javascript-sdk/react-client-side/package.json @@ -39,7 +39,7 @@ "picomatch": "^2.3.2", "lodash": "^4.18.0", "@babel/plugin-transform-modules-systemjs": ">=7.29.4", - "fast-uri": ">=3.1.2", + "fast-uri": "^3.1.4", "shell-quote": "1.9.0", "ws": ">=7.5.11", "websocket-driver": "^0.7.5",