chore(deps): lot sécu 02/09 — fast-uri (core) + tiptap 3.30.4 (frontend) - #667
Merged
Conversation
Divulgation coordonnée le 2026-09-02, 5 alertes Dependabot : - fast-uri 3.1.5 -> 3.1.7 (nodyx-core, transitif via fastify -> @fastify/ajv-compiler + fast-json-stringify). 4 CVE high : SSRF via normalisation IPv6 / re-décodage d'hôte, confusion d'hôte via schéma percent-encodé / IDN sur référence scheme-relative. `npm audit fix`, semver-compatible, lockfile seul. - @tiptap/* 3.27.1 -> 3.30.4 (nodyx-frontend, 17 paquets + famille). mergeAttributes() transformait une clé `__proto__` propre en attribut DOM hérité exécutable (prototype pollution). Nos appels mergeAttributes passent des objets statiques -> correctif transparent. Vérifs : core tsc + 971 tests ; frontend svelte-check 0 erreur, build prod OK, 150 tests. npm ci reproductible des deux côtés. 0 vulnérabilité après. prosemirror suit en patch/minor (model 1.25.11, view 1.42.3).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte — le « bizarre »
Rien d'anormal : divulgation coordonnée le 2026-09-02 de 5 avis GitHub-reviewed, tombés pendant qu'on regardait les PR.
fast-uriGHSA-jqff / fph4 / f65p / 5jgf (×4, high)@tiptap/coreGHSA-cp6q-959q-f8rh (medium)Versions correctives réelles et publiées. Aucun typosquat, tous les
resolveddu lockfile pointentregistry.npmjs.org.Changements
nodyx-core:fast-uri3.1.5 → 3.1.7 (lockfile seul,npm audit fix, semver-compatible)fastify→@fastify/ajv-compiler(validation de schéma de route) +fast-json-stringify(sérialisation).fastify5.12.1 embarque déjàfast-uri@4.1.4pour son sérialiseur v7 ; c'est la copie de dédup 3.1.x du compilateur ajv qui était vulnérable.nodyx-frontend:@tiptap/*3.27.1 → 3.30.4 (17 paquets + famille)mergeAttributes()transformait une clé__proto__propre en attribut DOM hérité exécutable (prototype pollution). Nos appels (NodyxEditor.svelte) passent tous des objets statiques → correctif transparent.prosemirror-*suit en patch/minor (model1.25.11,view1.42.3,changeset2.4.2,gapcursor1.4.1). Aucun major.Vérifs
tsc✓svelte-check0 erreurvite buildprod ✓npm cireproductiblenpm auditaprèsRésultat
Après ce merge : 0 alerte Dependabot ouverte (les 5 restantes étaient toutes celles-ci).
Scan de fond
nodyx-hub,nodyx-landing,nodyx-store,nodyx-docs,nodyx-authenticator:npm audit= 0.nodyx-p2p(cargo) : 0 alerte Dependabot rust ouverte (22 traitées historiquement).nodyx-core/api/v1/health: ok. Aucun auto-deploy de core surmain— déploiement manuel, décision mainteneur.