fix(repo): bump decompress to safe version - #36333
Merged
Merged
Conversation
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
View your CI Pipeline Execution ↗ for commit 7da69fb
☁️ Nx Cloud last updated this comment at |
leosvelperez
approved these changes
Jul 14, 2026
meeroslav
pushed a commit
that referenced
this pull request
Jul 16, 2026
…w52-cph6 (#36375) ## Current Behavior The daily **NPM Audit** workflow (`.github/workflows/npm-audit.yml`, which runs `pnpm dlx audit-ci --critical`) is failing on a critical advisory: - **[GHSA-xv26-6w52-cph6](https://github.com/advisories/GHSA-xv26-6w52-cph6)** (CVE-2026-54466, CVSS 9.2) - `websocket-driver` parses crafted protocol length headers into an integer large enough to lose precision in a 64-bit float, so the payload is parsed incorrectly. - Vulnerable range: `< 0.7.5`; patched in `0.7.5`. - The lockfile resolved `websocket-driver@0.7.4`, pulled in transitively via `webpack-dev-server > sockjs` (and `sockjs > faye-websocket`). The patch has been out since 2026-06-04. The advisory was only reviewed into the GitHub Advisory Database on 2026-07-15, which is when the audit started reporting it, so nothing changed on our side. ## Expected Behavior `websocket-driver` is pinned to the patched `^0.7.5` via a pnpm override, so all consumers resolve the safe version and the audit passes with `critical: 0`. Verified locally with the exact CI command: ``` pnpm dlx audit-ci --critical --report-type summary -> "critical": 0 -> Passed pnpm security audit. ``` `websocket-driver@0.7.5` clears the repo's `minimumReleaseAge` gate. ## Implementation Details Both consumers already allow the patched version (`sockjs@0.3.24` asks for `^0.7.4`, `faye-websocket@0.11.4` for `>=0.5.1`), so the lockfile was simply stale. The override is not needed to unblock the resolution, but it keeps every path on a safe version and guards against a future consumer pulling an older one, matching how #35974 and #36333 handled the same situation. The override only affects this repo's lockfile. It is not published, and it does not change what users resolve: `webpack-dev-server` is an optional peer dependency of `@nx/webpack`, so a downstream install resolves `websocket-driver` on its own and already picks up `0.7.5`. <!-- polygraph-session-start --> --- [View session information ↗](https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/fix-security-audit-b0c1e833) <!-- polygraph-session-end -->
FrozenPandaz
pushed a commit
that referenced
this pull request
Jul 20, 2026
<!-- Please make sure you have read the submission guidelines before posting an PR --> <!-- https://github.com/nrwl/nx/blob/master/CONTRIBUTING.md#-submitting-a-pr --> <!-- Please make sure that your commit message follows our format --> <!-- Example: `fix(nx): must begin with lowercase` --> <!-- If this is a particularly complex change or feature addition, you can request a dedicated Nx release for this pull request branch. Mention someone from the Nx team or the `@nrwl/nx-pipelines-reviewers` and they will confirm if the PR warrants its own release for testing purposes, and generate it for you if appropriate. --> ## Current Behavior <!-- This is the behavior we have today --> ## Expected Behavior <!-- This is the behavior we should expect with the changes in this PR --> ## Related Issue(s) <!-- Please link the issue being fixed so it gets closed when this is merged. --> Fixes # (cherry picked from commit e84c705)
FrozenPandaz
pushed a commit
that referenced
this pull request
Jul 20, 2026
…w52-cph6 (#36375) ## Current Behavior The daily **NPM Audit** workflow (`.github/workflows/npm-audit.yml`, which runs `pnpm dlx audit-ci --critical`) is failing on a critical advisory: - **[GHSA-xv26-6w52-cph6](https://github.com/advisories/GHSA-xv26-6w52-cph6)** (CVE-2026-54466, CVSS 9.2) - `websocket-driver` parses crafted protocol length headers into an integer large enough to lose precision in a 64-bit float, so the payload is parsed incorrectly. - Vulnerable range: `< 0.7.5`; patched in `0.7.5`. - The lockfile resolved `websocket-driver@0.7.4`, pulled in transitively via `webpack-dev-server > sockjs` (and `sockjs > faye-websocket`). The patch has been out since 2026-06-04. The advisory was only reviewed into the GitHub Advisory Database on 2026-07-15, which is when the audit started reporting it, so nothing changed on our side. ## Expected Behavior `websocket-driver` is pinned to the patched `^0.7.5` via a pnpm override, so all consumers resolve the safe version and the audit passes with `critical: 0`. Verified locally with the exact CI command: ``` pnpm dlx audit-ci --critical --report-type summary -> "critical": 0 -> Passed pnpm security audit. ``` `websocket-driver@0.7.5` clears the repo's `minimumReleaseAge` gate. ## Implementation Details Both consumers already allow the patched version (`sockjs@0.3.24` asks for `^0.7.4`, `faye-websocket@0.11.4` for `>=0.5.1`), so the lockfile was simply stale. The override is not needed to unblock the resolution, but it keeps every path on a safe version and guards against a future consumer pulling an older one, matching how #35974 and #36333 handled the same situation. The override only affects this repo's lockfile. It is not published, and it does not change what users resolve: `webpack-dev-server` is an optional peer dependency of `@nx/webpack`, so a downstream install resolves `websocket-driver` on its own and already picks up `0.7.5`. <!-- polygraph-session-start --> --- [View session information ↗](https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/fix-security-audit-b0c1e833) <!-- polygraph-session-end --> (cherry picked from commit 0c96cd0)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
Expected Behavior
Related Issue(s)
Fixes #