Skip to content
This repository was archived by the owner on Jun 26, 2026. It is now read-only.

fix(root): resolve shell-quote, fast-xml-parser, and uuid dependency vulnerabilities fixes DOC-344 #1124

Merged
jainpawan21 merged 1 commit into from
Jun 17, 2026
Merged

fix(root): resolve shell-quote, fast-xml-parser, and uuid dependency vulnerabilities fixes DOC-344 #1124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@
"flatted@<3.4.2": "^3.4.2",
"form-data@>=4.0.0 <4.0.4": "^4.0.4",
"fast-xml-parser@<4.5.5": "^4.5.5",
"fast-xml-parser@<5.7.0": "^5.7.0",
Comment on lines 122 to +123

@greptile-apps greptile-apps Bot Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Remove overlapping override

The old fast-xml-parser@<4.5.5 override still overlaps the new fast-xml-parser@<5.7.0 override, but they point to different replacement ranges. For a dependency that originally resolves below 4.5.5, two override rules now match and one of them still remediates only to ^4.5.5, which is below the new advisory floor this PR is trying to enforce. This can make fresh installs or audits apply the older remediation target instead of consistently forcing all vulnerable fast-xml-parser versions to ^5.7.0.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: package.json
Line: 122-123

Comment:
**Remove overlapping override**

The old `fast-xml-parser@<4.5.5` override still overlaps the new `fast-xml-parser@<5.7.0` override, but they point to different replacement ranges. For a dependency that originally resolves below `4.5.5`, two override rules now match and one of them still remediates only to `^4.5.5`, which is below the new advisory floor this PR is trying to enforce. This can make fresh installs or audits apply the older remediation target instead of consistently forcing all vulnerable `fast-xml-parser` versions to `^5.7.0`.

How can I resolve this? If you propose a fix, please make it concise.

Fix in Cursor

"glob@>=10.2.0 <10.5.0": "^10.5.0",
"js-yaml@<3.14.2": "^3.14.2",
"js-yaml@>=4.0.0 <4.1.1": "^4.1.1",
Expand All @@ -128,10 +129,12 @@
"minimatch@>=9.0.0 <9.0.7": "^9.0.7",
"picomatch@<2.3.2": "^2.3.2",
"serialize-javascript@<7.0.5": "^7.0.5",
"shell-quote@>=1.1.0 <=1.8.3": "^1.8.4",

@greptile-apps greptile-apps Bot Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Mirror workspace override

This adds the shell-quote security override only under package.json, but the repo also keeps pnpm overrides in pnpm-workspace.yaml, where the related fast-xml-parser and uuid fixes already live. Installs that use the workspace settings as the source of truth can miss this new shell-quote override and continue resolving @scalar/api-client's vulnerable transitive range without the forced 1.8.4 patch. Add the same override to pnpm-workspace.yaml and regenerate the lockfile so both pnpm configuration sources enforce the critical advisory fix.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: package.json
Line: 132

Comment:
**Mirror workspace override**

This adds the `shell-quote` security override only under `package.json`, but the repo also keeps pnpm overrides in `pnpm-workspace.yaml`, where the related `fast-xml-parser` and `uuid` fixes already live. Installs that use the workspace settings as the source of truth can miss this new `shell-quote` override and continue resolving `@scalar/api-client`'s vulnerable transitive range without the forced `1.8.4` patch. Add the same override to `pnpm-workspace.yaml` and regenerate the lockfile so both pnpm configuration sources enforce the critical advisory fix.

How can I resolve this? If you propose a fix, please make it concise.

Fix in Cursor

"seroval@<1.4.1": "^1.4.1",
"socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6",
"svgo@>=3.0.0 <3.3.3": "^3.3.3",
"undici@<6.24.0": "^6.24.0"
"undici@<6.24.0": "^6.24.0",
"uuid@<11.1.1": "^11.1.1"
}
},
"packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017"
Expand Down
65 changes: 48 additions & 17 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading