[DependOnMe] Critical security fix - 1 issue(s)#669
Open
dependonme-deriv wants to merge 2 commits into
Open
Conversation
Automatically regenerated by DependOnMe bot after package.json update. Branch: dependonme/bulk-fix-9bb8fc15 Package manager: npm
dependonme-deriv
requested review from
matin-deriv,
mayuran-deriv and
nijil-deriv
as code owners
dependonme-deriv
had a problem deploying
to
staging
GitHub Actions
Failure
Contributor
|
Claude finished @dependonme-deriv's task in 3m 5s —— View job Claude Code ReviewI reviewed the
✅ The security fix itself is correct
🔴 High —
|
| Priority | Item |
|---|---|
| 🟢 Good | shell-quote@1.8.4 pinned via overrides + devDependencies; resolves correctly. CVE fix is valid. |
| 🔴 High | Lock file has ~1,660 lines of unrelated removals (whole semantic-release peer tree + test tooling). Regenerate with the CI-pinned npm so the diff is minimal and auditable. |
| 🟡 Low | package.json is missing its trailing newline — likely fails test:lint. |
No runtime/build regression is expected (removed packages aren't direct deps), but I'd ask the author to shrink the lock diff before merge so this remains a clean, reviewable security change.
This is review feedback only — I have not pushed any changes. Let me know if you'd like me to apply the two fixes above.
Contributor
|
Contributor
Dependency ReviewThe following issues were found:
OpenSSF ScorecardScorecard details
Scanned Manifest Filespackage-lock.json
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bulk Security Fix
This pull request was automatically generated by DependOnMe to fix 1 critical security issue(s).
Issues Fixed
Files Modified
package.jsonAI Summary
Fixed 1 security issue:
CVE-2026-9277 —
shell-quoteNewline Injection inquote()(CRITICAL)"shell-quote": "^1.8.4"to theoverridessection to force all transitive consumers ofshell-quoteto use the patched version."shell-quote": "^1.8.4"todevDependenciesto make the pinned version explicit (it is present in the allowed package list and already transitively consumed by tools likewebpack-dev-server).shell-quotebetween 1.1.0 and 1.8.3 (inclusive) do not escape newline characters in object.opvalues passed toquote(). This can allow an attacker who controls input to inject arbitrary shell commands, leading to Remote Code Execution in contexts where the output ofquote()is passed to a shell.overridesentry is the most reliable way to guarantee every nested copy ofshell-quotein the dependency tree is replaced with the patched version. The directdevDependenciesentry ensures it is resolved at the top level as well.🧪 Testing Checklist:
npm install(ornpm ci) to regeneratepackage-lock.jsonand verifyshell-quote@1.8.4is resolved throughout the treenpm ls shell-quoteand confirm no version older than 1.8.4 appears anywhere in the outputnpm testnpm run buildnpm run test:lintnpm start🔧 Manual Steps:
npm installto regeneratepackage-lock.json.package.jsonand the updatedpackage-lock.jsontogether.node_modules, invalidate/clear the cache so the patched version is actually installed in CI.This PR was created by DependOnMe - Automated Security Issue Management