fix(security): patch ws, hono, uuid, axios CVEs across examples#37
Conversation
Force patched transitive versions via pnpm overrides (pnpm-workspace.yaml for pnpm-11 examples; package.json pnpm.overrides for with-openfort/backend on pnpm 9). Lockfiles regenerated with each example's pinned pnpm version. - ws -> 8.20.1 (CVE-2026-45736). 8.x line only; existing 7.x pins such as 7.5.10 are preserved. - hono -> 4.12.25 (GHSA-88fw-hqm2-52qc and related advisories). - uuid -> 11.1.1 (CVE-2026-41907). Scoped to the flagged 8.x/9.x line (uuid@>=8.0.0 <11.1.1); unflagged 3.x/7.x and 14.x transitive copies are left untouched to avoid unrelated cross-major churn. - axios -> 1.16.1 (1.x line) and 0.32.0 (0.x line, with-thirdweb). Override selectors use vulnerable-range keys so any affected version in the branch is patched. with-angular is intentionally excluded: it is not flagged for any of these and re-resolving hono conflicts with its Angular security-patch release-age pins. https://claude.ai/code/session_01CaVCXJd9wtcjwjXTizs6b1
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request applies security overrides across multiple workspace configurations and lockfiles to enforce patched transitive dependency versions (such as ws, uuid, hono, and axios) for Aikido CVE remediation. The review feedback recommends wrapping unquoted keys containing special characters (e.g., hono@<4.12.25 and axios@<0.32.0) in single quotes within the overrides block of several pnpm-workspace.yaml files. This change ensures formatting consistency and prevents potential YAML parsing issues.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| 'ws@>=7.0.0 <7.5.10': 7.5.10 | ||
| 'ws@>=8.0.0 <8.17.1': 8.17.1 | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| axios@<0.32.0: 0.32.0 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the axios@<0.32.0 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'axios@<0.32.0': 0.32.0| 'uuid@>=11.0.0 <11.1.1': 11.1.1 | ||
| 'axios@>=1.0.0 <1.16.1': 1.16.1 | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| # Security: force patched transitive versions (Aikido CVE remediation). | ||
| overrides: | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| # Security: force patched transitive versions (Aikido CVE remediation). | ||
| overrides: | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| 'elliptic@<=6.6.0': 6.6.1 | ||
| '@babel/traverse@<7.23.2': 7.23.2 | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| # Security: force patched transitive versions (Aikido CVE remediation). | ||
| overrides: | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| 'axios@>=1.0.0 <1.16.1': 1.16.1 | ||
| 'js-cookie@<3.0.6': 3.0.6 | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| # Security: force patched transitive versions (Aikido CVE remediation). | ||
| overrides: | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25| 'crypto-es@<2.1.0': 2.1.0 | ||
| 'ws@>=8.0.0 <8.17.1': 8.17.1 | ||
| 'ws@>=8.0.0 <8.20.1': 8.20.1 | ||
| hono@<4.12.25: 4.12.25 |
There was a problem hiding this comment.
For consistency with the other keys in the overrides block, please wrap the hono@<4.12.25 key in single quotes. This also prevents potential YAML parsing issues with special characters like @ and <.
'hono@<4.12.25': 4.12.25…-data, shell-quote, esbuild) The first commit cleared the four Aikido alerts, but the CI `audit` job (`pnpm audit --prod`) surfaces a pre-existing 2026 advisory backlog across the examples — latent on main because CI only audits changed examples. This clears every audit gate: - ws -> 8.21.0: a second advisory (memory-exhaustion DoS) requires >=8.21.0, above the 8.20.1 Aikido fix. 7.x line -> 7.5.11. - form-data -> 4.0.6 / 3.0.5 (high-gate examples that resolve it in prod). - shell-quote -> 1.8.4 (with-react, with-react-native; matches the pin with-crossmint already carries). - esbuild -> 0.28.1 (with-web3-onboard prod tree). The form-data and esbuild patches are <7 days old, so the affected packages (including the platform-specific @esbuild/*) are added to minimumReleaseAgeExclude. Override keys are quoted for consistency (addresses automated review feedback). Verified locally: every example passes `pnpm audit --prod` at its CI gate level, and builds pass (incl. web3-onboard with esbuild 0.28.1). https://claude.ai/code/session_01CaVCXJd9wtcjwjXTizs6b1
2 participants
Summary
Resolves the Aikido dependency alerts for ws, hono, uuid, and axios across the example apps by forcing patched transitive versions through pnpm overrides and regenerating each lockfile.
with-thirdweb0.x → 0.32.0How
The pnpm‑11 examples read overrides from
pnpm-workspace.yaml(notpackage.jsonpnpm.overrides), so entries were added there — matching the repo's existing Aikido-remediation convention.with-openfort/backendis on pnpm 9 and usespackage.jsonpnpm.overrides. Selectors target the vulnerable ranges (e.g.ws@>=8.0.0 <8.20.1: 8.20.1) so any affected version in the branch is patched, and each lockfile was regenerated with the example's pinned pnpm version.uuid scoping (note for reviewer)
Commit #24 deliberately scoped the uuid override to 11.x to avoid bumping transitive uuid
8.3.2/9.0.1, which were then "outside the flagged CVE." CVE-2026-41907 now flags exactly those versions, so this PR widens the selector touuid@>=8.0.0 <11.1.1 → 11.1.1. It still leaves the unflagged ancient (3.3.2,7.0.3) and newer (14.0.0) transitive copies untouched to avoid unrelated cross-major churn.Scope
Verification
pnpm audit --prodrun locally for every changed example (CI matrix replicated); theBuild Examplesworkflow validates the rest.https://claude.ai/code/session_01CaVCXJd9wtcjwjXTizs6b1
Generated by Claude Code
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.