From 0df0a4b8886b7bbf5ccf4d167a636adae2d2c12a Mon Sep 17 00:00:00 2001 From: ch-asimakopoulos Date: Fri, 31 Jul 2026 17:36:35 +0300 Subject: [PATCH] Fix lodash, urijs and path-to-regexp advisories in lib Chain 2 of 4. Resolves alerts #55 (lodash, code injection via _.template imports key names), #21 (urijs, incorrect protocol extraction via \r \n \t) and #37 (path-to-regexp, backtracking regular expressions) in lib/package-lock.json. lodash 4.17.21 -> 4.18.1 (direct dependency) urijs 1.19.6 -> 1.19.11 (via koa-router) path-to-regexp 1.8.0 -> 1.9.0 (via koa-router) All three are plain semver-compatible updates. koa-router 7.4.0 accepts urijs "^1.19.2" and path-to-regexp "^1.1.1", so both transitive fixes land without overrides; only the direct lodash range needed editing. path-to-regexp deserves a note: the fix for the backtracking advisory was backported to the 1.x line as 1.9.0, so this stays on koa-router 7 rather than needing the koa-router 12 / path-to-regexp 8 jump. lib only consumes lodash/merge and lodash/isEmpty, neither of which is touched by the _.template advisory or by anything in the 4.17 -> 4.18 range. Changes are confined to the intended packages. A full diff of the runtime tree before and after shows only the three bumps above, plus incidental in-range moves of hoek 4.2.1 -> 4.3.1 and topo 2.0.2 -> 2.1.1 underneath koa-joi-validate, which chain 3 removes outright. Verified: the three alerts report clear, 9/9 tests pass, and lib/index still loads. The build.test.js snapshot is unchanged, which is the useful signal here - it captures the router's compiled regexes, so path-to-regexp 1.9.0 produces byte-identical routing output. Remaining in this lockfile: hoek (chain 3), a moderate joi link() issue, and brace-expansion, whose advisory has no patched version at any release. Co-Authored-By: Claude Opus 5 (1M context) --- lib/package-lock.json | 30 +++++++++++++++--------------- lib/package.json | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/lib/package-lock.json b/lib/package-lock.json index 5498014..98a77fe 100644 --- a/lib/package-lock.json +++ b/lib/package-lock.json @@ -2271,9 +2271,9 @@ }, "dependencies": { "hoek": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.2.1.tgz", - "integrity": "sha512-QLg82fGkfnJ/4iy1xZ81/9SIJiq1NGFUMGs6ParyjBZr6jW2Ufj/snDqTHixNlHdPNwN2RLVD0Pi3igeK9+JfA==" + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.3.1.tgz", + "integrity": "sha512-v7E+yIjcHECn973i0xHm4kJkEpv3C8sbYS4344WXbzYqRyiDD7rjnnKo4hsJkejQBAFdRMUGNHySeSPKSH9Rqw==" }, "isemail": { "version": "2.2.1", @@ -2292,9 +2292,9 @@ } }, "topo": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/topo/-/topo-2.0.2.tgz", - "integrity": "sha1-zVYVdSU5BXwNwEkaYhw7xvvh0YI=", + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/topo/-/topo-2.1.1.tgz", + "integrity": "sha512-ZPrPP5nwzZy1fw9abHQH2k+YarTgp9UMAztcB3MmlcZSif63Eg+az05p6wTDaZmnqpS3Mk7K+2W60iHarlz8Ug==", "requires": { "hoek": "4.x.x" } @@ -2346,9 +2346,9 @@ } }, "lodash": { - "version": "4.17.21", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz", - "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==" + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", + "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==" }, "lru-cache": { "version": "5.1.1", @@ -2569,9 +2569,9 @@ } }, "path-to-regexp": { - "version": "1.8.0", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz", - "integrity": "sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA==", + "version": "1.9.0", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.9.0.tgz", + "integrity": "sha512-xIp7/apCFJuUHdDLWe8O1HIkb0kQrOMb/0u6FXQjemHn/ii5LrIzU6bdECnsiTF/GjZkMEKg1xdiZwNqDYlZ6g==", "requires": { "isarray": "0.0.1" } @@ -3006,9 +3006,9 @@ } }, "urijs": { - "version": "1.19.6", - "resolved": "https://registry.npmjs.org/urijs/-/urijs-1.19.6.tgz", - "integrity": "sha512-eSXsXZ2jLvGWeLYlQA3Gh36BcjF+0amo92+wHPyN1mdR8Nxf75fuEuYTd9c0a+m/vhCjRK0ESlE9YNLW+E1VEw==" + "version": "1.19.11", + "resolved": "https://registry.npmjs.org/urijs/-/urijs-1.19.11.tgz", + "integrity": "sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==" }, "v8-to-istanbul": { "version": "9.3.0", diff --git a/lib/package.json b/lib/package.json index 91d89f8..24f584e 100644 --- a/lib/package.json +++ b/lib/package.json @@ -31,7 +31,7 @@ "koa-compose": "^4.1.0", "koa-joi-validate": "^0.5.1", "koa-router": "^7.4.0", - "lodash": "^4.17.20", + "lodash": "^4.18.1", "require-directory": "^2.1.1" }, "devDependencies": {