From 52ce6e9aca68850f5b5fd028fdb5af329f912247 Mon Sep 17 00:00:00 2001 From: Jason Ross Date: Thu, 2 Jul 2026 15:39:54 -0500 Subject: [PATCH] #36 Security: patch vulnerable transitive deps form-data + uuid Force patched versions of two vulnerable transitive dev-tooling deps flagged by Dependabot. Both are dev-only (pulled in transitively by wrangler / @usebruno/cli) and are not part of the Go/Wasm Worker: - form-data 4.0.4 -> 4.0.6 (HIGH, CRLF injection; vuln >=4.0.0 <4.0.6) - uuid 10.0.0 -> 14.0.1 (MEDIUM, buffer bounds; vuln <11.1.1) The pnpm overrides live in pnpm-workspace.yaml (the `overrides:` key) rather than package.json's `pnpm.overrides` because pnpm 11 no longer reads the "pnpm" field in package.json (it warns and ignores it). This sits alongside the existing allowBuilds config in the same file. The lockfile was regenerated so form-data resolves to a single 4.0.6 and uuid to 14.0.1 (the >=11.1.1 override resolves to the latest published uuid, which is well above the vulnerable <11.1.1 range). Verified locally: - pnpm install and pnpm install --frozen-lockfile exit 0 - pnpm run test:api (Bruno suite) passes 8/8 against go devserver - pnpm exec wrangler --version -> 4.106.0 Co-Authored-By: Claude Opus 4.8 --- pnpm-lock.yaml | 27 +++++++++------------------ pnpm-workspace.yaml | 11 +++++++++++ 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a1b434b..7a0fa75 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,10 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + form-data: '>=4.0.6' + uuid: '>=11.1.1' + importers: .: @@ -1161,10 +1165,6 @@ packages: debug: optional: true - form-data@4.0.4: - resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==} - engines: {node: '>= 6'} - form-data@4.0.6: resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} @@ -1793,9 +1793,8 @@ packages: util@0.10.4: resolution: {integrity: sha512-0Pm9hTQ3se5ll1XihRic3FDIku70C+iHUdT/W926rSgHV5QgXsYbKZN8MSC3tJtSkhuROzvsQjAaFENRXr+19A==} - uuid@10.0.0: - resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==} - deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). + uuid@14.0.1: + resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==} hasBin: true webidl-conversions@3.0.1: @@ -2710,7 +2709,7 @@ snapshots: csv-parse: 5.6.0 debug: 4.4.3 decomment: 0.9.5 - form-data: 4.0.4 + form-data: 4.0.6 fs-extra: 10.1.0 http-proxy-agent: 7.0.2 https-proxy-agent: 7.0.6 @@ -2773,7 +2772,7 @@ snapshots: path: 0.12.7 quickjs-emscripten: 0.32.0 tv4: 1.3.0 - uuid: 10.0.0 + uuid: 14.0.1 xml-formatter: 3.7.0 xml2js: 0.6.2 yaml: 2.9.0 @@ -3205,14 +3204,6 @@ snapshots: optionalDependencies: debug: 4.4.3 - form-data@4.0.4: - dependencies: - asynckit: 0.4.0 - combined-stream: 1.0.8 - es-set-tostringtag: 2.1.0 - hasown: 2.0.4 - mime-types: 2.1.35 - form-data@4.0.6: dependencies: asynckit: 0.4.0 @@ -3836,7 +3827,7 @@ snapshots: dependencies: inherits: 2.0.3 - uuid@10.0.0: {} + uuid@14.0.1: {} webidl-conversions@3.0.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 6f2ce73..81a797c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,3 +9,14 @@ allowBuilds: protobufjs: true sharp: true workerd: true + +# Force patched versions of vulnerable transitive dev-tooling deps (see #36). +# form-data <4.0.6 has a HIGH CRLF-injection advisory; uuid <11.1.1 has a MEDIUM +# buffer-bounds advisory. Both are pulled in transitively by wrangler / +# @usebruno/cli and are dev-only (not in the Go/Wasm Worker). pnpm 11 no longer +# reads the "pnpm" field in package.json, so overrides live here alongside the +# build-approval config. Values are quoted because a leading ">" is a YAML +# block-scalar indicator. +overrides: + form-data: '>=4.0.6' + uuid: '>=11.1.1' -- 2.47.3