Repository navigation
fix(cli): patch vulnerable fast-uri on the production Ajv path #463
Description
Problem
The CLI validates third-party plugin manifests with [email protected]. Ajv depends on fast-uri@^3.0.1 in the production dependency graph.
The repository currently declares pnpm.overrides.fast-uri: >=3.1.2; the resolved lockfile includes vulnerable fast-uri releases. pnpm audit --prod reports six high-severity advisories for this path:
- GHSA-4c8g-83qw-93j6
- GHSA-v2hh-gcrm-f6hx
- GHSA-7p8r-x3mc-p8w7
- GHSA-f65p-4m7j-42xc
- GHSA-fph4-wmhf-6fwf
- GHSA-jqff-g426-hqxp
This is a production input-validation dependency. It is not evidence of a CLI-initiated SSRF by itself: the CLI validates URI-shaped schema fields but does not fetch those URIs. The dependency still needs a security patch.
Target
Pin the override to the smallest Ajv-compatible patched v3 range:
"fast-uri": ">=3.1.6 <4"This preserves Ajv 8 compatibility, avoids an unrelated forced v4 migration, and excludes every currently reported vulnerable v3 release.
Acceptance criteria
-
cli/package.jsonconstrainsfast-urito>=3.1.6 <4. - Regenerated
cli/pnpm-lock.yamlresolves a patched v3 release for the production Ajv path. -
pnpm audit --prod --jsonreports none of the six advisories above forfast-uri. - The CLI manifest-validation tests still pass.
- The corrective commit lands on
nextbefore PR #795 is merged; feat(cli): one shared framework source per machine, user scope and session telemetry #795 then incorporates it.
Delivery boundary
One small security commit: override, lockfile, and verification only. No CLI/context refactor.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Projects
- Status
Activity
blafourcade commentedon Sep 9, 2026
Integration dependency
PR #795 carries the current override and vulnerable lock resolution unchanged. The remediation should land as a small security commit on
next; #795 must then incorporate it before merge.This is intentionally not folded into the refactor: its dependency update, lockfile diff, production audit, and regression evidence need an independently reviewable change.
[-]fix(cli): fast-uri override still resolves the vulnerable version, reachable from production ajv[/-][+]fix(cli): patch vulnerable fast-uri on the production Ajv path[/+]fix(cli): pin fast-uri to the patched Ajv-compatible v3 range
fix(cli): pin fast-uri to the patched Ajv-compatible v3 range
blafourcade commentedon Sep 16, 2026
Still reproducible on
next(83b0246). Re-checked today, and the advisory set has moved since this was opened — the package is now on the 4.x line, not 3.x.cd cli && pnpm audit --prodexits 1 with 6 high advisories, all on the same two paths (.>ajv>fast-uri,.>ajv-formats>ajv>fast-uri):>=4.0.0 <4.0.1>=4.0.1>=4.0.0 <=4.1.0>=4.1.1>=4.0.0 <4.1.2>=4.1.2>=4.0.0 <4.1.3>=4.1.3>=4.0.0 <4.1.3>=4.1.3>=4.0.0 <4.1.3>=4.1.3Cause:
cli/pnpm-workspace.yaml:14declaresfast-uri: '>=3.1.2'. That floor was written for the 3.x advisories and no longer constrains anything — the lockfile resolves[email protected], which every advisory above covers.>=4.1.3patches all six. The resolved version is already on the 4.x line, so this is a floor bump within the major already in use, not a major upgrade.latestis4.1.5.Suggested fix, and how to prove it:
cli/pnpm-workspace.yaml, theoverridesblock:fast-uri: '>=4.1.3'.cd cli && pnpm install --lockfile-onlyto refresh the resolution.cd cli && pnpm audit --prodmust exit 0.cd cli && pnpm testandpnpm build—ajvvalidates third-party plugin manifests, so the manifest-validation suite is the one that would notice a regression.Labelling this
good first issue: one line, one lockfile refresh, and a command that says yes or no.Dev-only advisories are out of scope here — they belong to #469.
Generated by Claude Code
fix(cli): pin fast-uri to the patched Ajv-compatible v3 range (#830)
blafourcade commentedon Sep 20, 2026
Corrigé par #830, mergé dans
next(c79565b).Mesuré, pas supposé :
nextà 552eda1~2)cli/pnpm-workspace.yamlfast-uri: '>=3.1.2'fast-uri: '>=3.1.6 <4'[email protected][email protected]sous[email protected]pnpm audit --prod{info:0, low:0, moderate:0, high:0, critical:0}Les six : GHSA-v2hh-gcrm-f6hx, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-4c8g-83qw-93j6. La description de la PR en citait cinq ; une sixième est apparue depuis.
Vérifié sur l'arbre fusionné avec
next:pnpm install --frozen-lockfilepasse,pnpm why fast-uri --prodrenvoieFound 1 version, 4450 tests unit et 1848 integration verts.Reste ouvert et hors périmètre : passer à
fast-uri@>=4.1.3demande une montée d'Ajv et sa propre validation.Fermée à la main : la PR a atterri sur
next, et GitHub n'auto-ferme que sur la branche par défaut.