wangziqi/gongxue-base
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: 修复 npm 高危依赖漏洞 #43

Merged
wangziqi merged 1 commits from worktree-npm-security-updates into main 2026-07-23 04:12:11 +00:00
Conversation 0 Commits 1 Files Changed 2 +46 -98
wangziqi commented 2026-07-23 04:04:07 +00:00
Owner
Copy Link

Summary

  • upgrade @nestjs/platform-express to 11.1.28 and deduplicate on multer 2.2.0
  • upgrade TypeORM to 0.3.31
  • update vulnerable brace-expansion 1.x/2.x lockfile entries
  • reduce production audit findings from 3 high + 3 moderate to 0 high + 2 moderate

Remaining audit finding

The two remaining moderate entries are the same exceljs@4.4.0 -> uuid@8.3.2 advisory. npm only proposes a breaking downgrade to exceljs@3.4.0; the affected UUID APIs are v3/v5/v6 buffer calls while ExcelJS uses UUID v4, so this PR intentionally avoids npm audit fix --force.

Verification

  • clean lockfile install (npm ci --ignore-scripts)
  • frontend and backend lint
  • full workspace typecheck
  • frontend and backend builds
  • backend tests: 92 suites, 713 passed, 1 skipped
  • focused SQLite integration tests: 6 passed
  • security review: no newly introduced qualifying findings
## Summary - upgrade `@nestjs/platform-express` to 11.1.28 and deduplicate on `multer` 2.2.0 - upgrade TypeORM to 0.3.31 - update vulnerable `brace-expansion` 1.x/2.x lockfile entries - reduce production audit findings from 3 high + 3 moderate to 0 high + 2 moderate ## Remaining audit finding The two remaining moderate entries are the same `exceljs@4.4.0 -> uuid@8.3.2` advisory. npm only proposes a breaking downgrade to `exceljs@3.4.0`; the affected UUID APIs are v3/v5/v6 buffer calls while ExcelJS uses UUID v4, so this PR intentionally avoids `npm audit fix --force`. ## Verification - clean lockfile install (`npm ci --ignore-scripts`) - frontend and backend lint - full workspace typecheck - frontend and backend builds - backend tests: 92 suites, 713 passed, 1 skipped - focused SQLite integration tests: 6 passed - security review: no newly introduced qualifying findings
wangziqi added 1 commit 2026-07-23 04:04:07 +00:00
chore: patch vulnerable npm dependencies
All checks were successful
CI / check (pull_request) Successful in 1m33s
Details
eaca56617c
wangziqi changed title from WIP: chore: 修复 npm 高危依赖漏洞 to chore: 修复 npm 高危依赖漏洞 2026-07-23 04:12:09 +00:00
wangziqi merged commit adf738288f into main 2026-07-23 04:12:11 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
xiongyuxing wangziqi
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: wangziqi/gongxue-base#43
No description provided.
Delete Branch "worktree-npm-security-updates"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?