fix: close commonmark and bundled JS advisories, repair integration CI - #233
Draft
oleksandr-nc wants to merge 3 commits into
Draft
fix: close commonmark and bundled JS advisories, repair integration CI#233oleksandr-nc wants to merge 3 commits into
oleksandr-nc wants to merge 3 commits into
Conversation
league/commonmark 2.8.3 -> 2.10.0 closes four high-severity denial-of-service advisories and an AttributesExtension unsafe-link filter bypass. The converter is reached from GithubIssuePrReferenceProvider, which renders issue and pull request bodies, so the input is attacker-authorable. Pin the three vulnerable transitive npm packages through `overrides` instead of running `npm audit fix`, which resolved 58 package changes and nine major version jumps -- @nextcloud/files 4, @nextcloud/paths 3, vue-router 5, focus-trap 8, @vueuse/core 14 among them -- none of which belong in a patch release. The override route moves exactly three packages and adds none: dompurify 3.4.13, js-yaml 4.3.1, nanoid 3.3.18. This clears both remaining high-severity npm advisories. What is left is dev-only: the fast-xml-parser 4.x copy arrives via @nextcloud/eslint-config and needs the deferred eslint 10 flat-config migration, and elliptic has no upstream patch. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
The checkup page was already handled, but only when GitHub served a postable form at /settings/two_factor_checkup/delay. It is now sometimes rendered client-side as a bare /settings/two_factor_checkup form with no named inputs, which the delay-form matcher missed, so the run fell through to a generic "no form found" failure on every pull request. Detect that variant separately and skip with a message naming the fix, rather than failing. The account state is outside the app's control and a hard failure there hides real regressions in the OAuth flow. Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
league/commonmarkto 2.10.0, closing four high-severity denial-of-serviceadvisories and an
AttributesExtensionunsafe-link filter bypass on the converter thatrenders issue and pull request bodies, and pins dompurify, js-yaml and nanoid to their
patched versions through
overrides.Fixes the integration matrix, which paired PHP 8.2 with Nextcloud master even though
master requires 8.3, so
occ maintenance:installaborted before any test ran.Fixes the OAuth test failing on every pull request when GitHub serves its two-factor
checkup page as a bare client-rendered form: that variant is now detected and skipped
rather than reported as a generic missing-form failure.