chore(deps/js): resolve npm audit vulnerabilities - #651
Conversation
Override brace-expansion to ^5.0.9 and js-yaml to ^4.3.0 to clear 26 high severity advisories reported by npm audit.
📄 Knowledge reviewDosu skipped reviewing this PR because your organization has used its
|
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThe JavaScript package override configuration updates ChangesJavaScript dependency overrides
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates the JavaScript package’s dependency overrides to address npm audit findings in pkg/js/, bringing the JS workspace back to a clean security/audit state.
Changes:
- Bump the
js-yamloverride from^4.2.0to^4.3.0. - Add a
brace-expansionoverride at^5.0.9to eliminate vulnerable transitive versions and update the lockfile accordingly.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pkg/js/package.json | Updates overrides to newer js-yaml and introduces brace-expansion override for audit remediation. |
| pkg/js/package-lock.json | Reflects resolved dependency tree changes from the overrides (removes older nested vulnerable copies and pins updated versions). |
Files not reviewed (1)
- pkg/js/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/js/package.json`:
- Line 56: Update the dependency configuration around brace-expansion and the
minimatch@3 consumers so brace-expansion@5 is not forced onto minimatch@3, which
requires a callable CommonJS export. Upgrade all affected minimatch consumers
together, or use an override/patch that preserves the callable API while
retaining compatibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d275fea8-7acb-4c8f-b93c-cb2c79e2f7b1
⛔ Files ignored due to path filters (1)
pkg/js/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
pkg/js/package.json
| "overrides": { | ||
| "js-yaml": "^4.2.0" | ||
| "js-yaml": "^4.3.0", | ||
| "brace-expansion": "^5.0.9" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cd pkg/js
npm ci --ignore-scripts
node - <<'NODE'
const expansion = require('brace-expansion')
if (typeof expansion !== 'function') {
throw new Error(`brace-expansion CommonJS export is ${typeof expansion}, not callable`)
}
const minimatch = require('minimatch')
if (!minimatch('a.js', '*.js')) {
throw new Error('minimatch smoke test failed')
}
NODERepository: openfga/language
Length of output: 2079
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cd pkg/js
printf 'package.json override section:\n'
awk 'NR>=1,NR<=90' package.json | sed -n '45,65p'
printf '\nlock brace-expansion entries:\n'
python3 - <<'PY'
import json
p=json.load(open('package-lock.json'))
for k,v in p.get('packages',{}).items():
if k.endswith('brace-expansion') or k.endswith('minimatch'):
print(k, v.get('version'), v.get('dependencies'), v.get('peerDependencies'), v.get('engines'))
PY
printf '\nResolved brace-expansion/cjs files:\n'
node - <<'NODE'
const path = require.resolve('brace-expansion')
const be = require('brace-expansion')
console.log({path, type: typeof be, exports: Object.keys(byRequire(path))})
function byRequire(p) { try { return require.cache[p] && require.cache[p].exports ?? require(p) } catch (e) { console.error(e); process.exit(1) } }
NODE
printf '\nminimatch source call sites involving brace-expansion:\n'
sed -n '1,140p' node_modules/minimatch/minimatch.js | python3 - <<'PY'
import sys
text=sys.stdin.read()
for i,line in enumerate(text.splitlines(),1):
if 'brace' in line or i <= 160:
print(f'{i}: {line}')
PY
printf '\nTop package engines:\n'
sed -n '1,25p' package.jsonRepository: openfga/language
Length of output: 2441
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cd pkg/js
printf 'package.json override section:\n'
awk 'NR>=1,NR<=90' package.json | sed -n '45,65p'
printf '\nlock brace-expansion entries:\n'
python3 - <<'PY'
import json
p=json.load(open('package-lock.json'))
for k,v in p.get('packages',{}).items():
if k.endswith('brace-expansion') or k.endswith('minimatch'):
print(k, v.get('version'), v.get('dependencies'), v.get('peerDependencies'), v.get('engines'))
PY
printf '\nResolved brace-expansion CommonJS shape:\n'
node - <<'NODE'
const be = require('brace-expansion')
console.log(JSON.stringify({type: typeof be, constructor: (be.constructor && be.constructor.name), exportKeys: Object.keys(be)}, null, 2))
try {
be('a')
console.log('callable result', be('a'))
} catch (err) {
console.log(err.name + ': ' + err.message.split('\n')[0])
}
NODE
printf '\nMinimatch brace-expansion imports/calls:\n'
grep -n "brace" node_modules/minimatch/minimatch.js || true
printf '\nTop package engines:\n'
sed -n '1,30p' package.jsonRepository: openfga/language
Length of output: 2751
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cd pkg/js
printf 'Package manager / engines context:\n'
jq -r '{packageManager: .packageManager, engines: .engines}' package.json 2>/dev/null || true
printf '\nDirect call of brace-expansion CommonJS export:\n'
node - <<'NODE'
const be = require('brace-expansion')
try {
console.log('callable result:', be('a'))
} catch (err) {
console.log(err.name + ': ' + err.message.split('\n')[0])
}
NODE
printf '\nResolving minimatch versions affected by brace-expansion override:\n'
python3 - <<'PY'
import json
lock=json.load(open('package-lock.json'))
pkg=lock.get('packages',{}).get('',{})
print('workspace package manager:', pkg.get('packageManager'))
print('workspace engines:', pkg.get('engines'))
print()
for k in sorted(lock.get('packages',{}).keys()):
if 'minimatch' in (k.split('/')[-2:] if isinstance(k, str) else []):
v=lock['packages'][k]
print(k, v.get('version'), 'deps:', v.get('dependencies',{}), 'engines:', v.get('engines'))
PYRepository: openfga/language
Length of output: 1328
Do not force brace-expansion@5 onto minimatch@3.
brace-expansion@5.0.9 exports an object with expand, while minimatch@3.x dependencies still require brace-expansion through a direct callable import, which fails at runtime. Upgrade the affected minimatch@3 consumers together, or override/patch to a brace-expansion build that preserves the callable CommonJS API.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/js/package.json` at line 56, Update the dependency configuration around
brace-expansion and the minimatch@3 consumers so brace-expansion@5 is not forced
onto minimatch@3, which requires a callable CommonJS export. Upgrade all
affected minimatch consumers together, or use an override/patch that preserves
the callable API while retaining compatibility.
brace-expansion@5 exports an object ({ expand, ... }) instead of a
callable CommonJS function. Forcing it onto minimatch@3.x consumers
(eslint, eslint-plugin-import, test-exclude, @eslint/*) made
`require('brace-expansion')(pattern)` throw
"TypeError: expand is not a function" for any pattern containing braces.
The override is unnecessary: minimatch@3.x requests ^1.1.7, which
resolves to the patched brace-expansion@1.1.18, and npm audit reports
0 vulnerabilities without it.
Bumps the
brace-expansionoverride to^5.0.9andjs-yamlto^4.3.0, clearing the 26 high severity advisories that are currently failingmake audit-json main.Summary by CodeRabbit
brace-expansionto improve dependency consistency.