Bumping deps to avoid CVE (10/08/2025) #9187
Conversation
- Bumping deps to avoid CVE (10/08/2025) Signed-off-by: liranmauda <[email protected]>
WalkthroughThis change updates the versions of several dependencies in the Changes
Sequence Diagram(s)No sequence diagram generated as the changes are limited to dependency version bumps. Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Note 🔌 MCP (Model Context Protocol) integration is now available in Early Access!Pro users can now connect to remote MCP servers under the Integrations page to get reviews and chat conversations that understand additional development context. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
134-135: @types bump: ensure runtime Node matches 22.x; consider guarding with engines.Types target Node 22. If production runs on a different major (e.g., 20), consider aligning or adding an engines guard to prevent drift.
Here’s an optional addition to enforce supported runtimes:
{ "name": "noobaa-core", "version": "5.20.0", + "engines": { + "node": ">=22 <23" + }, "license": "SEE LICENSE IN LICENSE",
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Build Noobaa Image
- GitHub Check: run-package-lock-validation
- GitHub Check: run-jest-unit-tests
🔇 Additional comments (4)
package.json (4)
120-120: TypeScript 5.9.2: ensure CI compiles cleanly and types align with Node 22.Expect a few stricter checks vs 5.8.x. Please ensure
npm run tspasses and there’s no mismatch with@types/[email protected].
123-123: yaml 2.8.1 patch bump likely targets a CVE—good; verify no open advisories.Confirm that the specific CVE motivating this PR is resolved with 2.8.1 and that no new advisories affect this version (see OSV script above).
128-129: Dev AWS SDK bumps to 3.864.0 are consistent.Keeping dev-time SDK packages aligned with runtime versions reduces duplication and transitive drift.
141-141: node-gyp 11.3.0: verify native builds across platforms.Given native deps (nan, node-addon-api, bcrypt, heapdump, node-rdkafka), confirm toolchains are OK (Python 3.x, make/clang/VC Build Tools) and CI builds succeed on Linux/macOS. Watch for ABI changes with Node 22.
| "@aws-sdk/client-s3": "3.864.0", | ||
| "@aws-sdk/client-sts": "3.864.0", | ||
| "@aws-sdk/credential-providers": "3.864.0", | ||
| "@aws-sdk/s3-request-presigner": "3.864.0", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
AWS SDK v3 bump looks fine; double-check Smithy alignment and CVE status.
Pinned to 3.864.0 across SDK packages—good. Ensure transitive Smithy libs remain compatible with your pinned @smithy/node-http-handler (3.3.3). Also verify this addresses the targeted CVE and doesn’t introduce new advisories.
Run this OSV check against the new versions:
Additionally, once lockfile is updated, run npm audit --omit=dev to confirm zero production advisories tied to these bumps.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
pkgs=(
"@aws-sdk/[email protected]"
"@aws-sdk/[email protected]"
"@aws-sdk/[email protected]"
"@aws-sdk/[email protected]"
"[email protected]"
"[email protected]"
"@aws-sdk/[email protected]"
"@aws-sdk/[email protected]"
"@types/[email protected]"
"@types/[email protected]"
"[email protected]"
)
check_pkg() {
local name="${1%@*}"
local ver="${1#*@}"
jq -nc --arg n "$name" --arg v "$ver" '
{version:$v, package:{name:$n, ecosystem:"npm"}}
' | curl -s https://api.osv.dev/v1/query -H 'content-type: application/json' -d @- | \
jq --arg n "$name" --arg v "$ver" '
.vulns // [] | {package:$n, version:$v, vulns:[.[].id]}
'
}
echo '['
first=1
for p in "${pkgs[@]}"; do
out="$(check_pkg "$p")"
if [[ $first -eq 1 ]]; then
first=0
else
echo ','
fi
echo "$out"
done
echo ']'Length of output: 8804
AWS SDK v3 bump CVE check – no vulnerabilities found
All bumped packages (AWS SDK v3, TypeScript, yaml, @types, node-gyp) have no known OSV advisories at these versions. Good work on the upgrade.
Next steps to lock it in and avoid secondary issues:
- Regenerate your lockfile (
npm install) and commit the update. - Run
npm audit --omit=devto ensure zero production advisories. - Verify your transitive
@smithy/node-http-handlerremains at the intended 3.3.3 (e.g.npm list @smithy/node-http-handleror inspectpackage-lock.json). - Consider adding an
enginesfield (e.g."engines": {"node":">=18 <23"}) to guard against type/runtime drift with@types/node@22. - Confirm CI compiles under TS 5.9.2 and builds native addons with node-gyp 11.3.0 across all target platforms.
🤖 Prompt for AI Agents
In package.json around lines 75 to 78, after upgrading AWS SDK v3 and related
packages, regenerate the lockfile by running npm install and commit the updated
lockfile. Then run npm audit --omit=dev to confirm no production vulnerabilities
remain. Verify that the transitive dependency @smithy/node-http-handler is at
version 3.3.3 by using npm list or inspecting package-lock.json. Optionally, add
an engines field to package.json to specify supported Node.js versions to
prevent runtime issues. Finally, ensure the CI pipeline compiles with TypeScript
5.9.2 and builds native addons using node-gyp 11.3.0 on all target platforms.
2 participants
Explain the Changes
Summary by CodeRabbit