From 62efdba22e417f655c00fc670764fe46accaea4d Mon Sep 17 00:00:00 2001 From: le king fu Date: Mon, 5 Oct 2026 19:27:33 -0400 Subject: [PATCH 1/2] fix(security): add http-cache-semantics and postcss-selector-parser floors - http-cache-semantics ^4.3.0 (GHSA-ch52-4w7c-c8xp, high): 4.3.0 is out of the <=4.2.0 range although the advisory lists no patched version. Single copy via @expo/ngrok > got > cacheable-request (^4.0.0), dev tunnel only. - postcss-selector-parser@^6.0.0 -> ^6.1.3 (GHSA-w9m9-85wc-3x92, low), version-scoped to the tailwindcss@3 major. Resolves to 6.1.4. Lockfile: two stanzas, package count unchanged (2084). npm audit 33 -> 31. Android JS bundle (expo export --no-bytecode, cache cleared) is byte-identical before and after. Smoke test guards both floors. Resolves #128 Resolves #129 Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 12 ++++++------ package.json | 2 ++ tests/smoke.test.cjs | 29 +++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9b9783a..795a1e3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7068,9 +7068,9 @@ } }, "node_modules/http-cache-semantics": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz", - "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz", + "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==", "license": "BSD-2-Clause" }, "node_modules/http-errors": { @@ -9682,9 +9682,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz", - "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==", + "version": "6.1.4", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", + "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", diff --git a/package.json b/package.json index bece00d..f32e54a 100644 --- a/package.json +++ b/package.json @@ -71,6 +71,8 @@ "@xmldom/xmldom": "^0.8.15", "uuid": "^11.1.1", "postcss": "^8.5.18", + "postcss-selector-parser@^6.0.0": "^6.1.3", + "http-cache-semantics": "^4.3.0", "js-yaml@^3.0.0": "^3.15.2", "js-yaml@^4.0.0": "^4.3.2", "brace-expansion@^1.0.0": "^1.1.21", diff --git a/tests/smoke.test.cjs b/tests/smoke.test.cjs index 602ac52..e9ae2cc 100644 --- a/tests/smoke.test.cjs +++ b/tests/smoke.test.cjs @@ -306,6 +306,35 @@ check('every installed undici copy is >= 6.28.1', () => { ); }); +// --- Override floors (#128, #129) --- +// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got). +// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline); +// any other major is unexpected and must fail loudly. + +check('every installed http-cache-semantics copy is >= 4.3.0', () => { + const copies = installedCopies('http-cache-semantics'); + assert.ok(copies.length > 0, 'http-cache-semantics is not installed'); + const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0')); + assert.deepEqual( + strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`), + [], + 'http-cache-semantics must be >= 4.3.0' + ); +}); + +check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => { + const copies = installedCopies('postcss-selector-parser'); + assert.ok(copies.length > 0, 'postcss-selector-parser is not installed'); + const strays = copies.filter( + (c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3') + ); + assert.deepEqual( + strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`), + [], + 'postcss-selector-parser must be 6.x >= 6.1.3' + ); +}); + // The call that broke under the blanket override: each minimatch copy must // still expand braces through its own brace-expansion major. check('every installed minimatch copy still matches globs and braces', () => { -- 2.45.2 From cb53a43422c2fc6a628757a6205528da5c130199 Mon Sep 17 00:00:00 2001 From: le king fu Date: Mon, 5 Oct 2026 19:34:25 -0400 Subject: [PATCH 2/2] fix(security): scope http-cache-semantics floor to major 4 Review follow-up on #131: a blanket override would force any future 5.x consumer down to 4.x. The version-scoped key keeps the floor within the current major, like postcss-selector-parser. No lockfile change. Refs #128 Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- tests/smoke.test.cjs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index f32e54a..afae8f0 100644 --- a/package.json +++ b/package.json @@ -72,7 +72,7 @@ "uuid": "^11.1.1", "postcss": "^8.5.18", "postcss-selector-parser@^6.0.0": "^6.1.3", - "http-cache-semantics": "^4.3.0", + "http-cache-semantics@^4.0.0": "^4.3.0", "js-yaml@^3.0.0": "^3.15.2", "js-yaml@^4.0.0": "^4.3.2", "brace-expansion@^1.0.0": "^1.1.21", diff --git a/tests/smoke.test.cjs b/tests/smoke.test.cjs index e9ae2cc..78cfb23 100644 --- a/tests/smoke.test.cjs +++ b/tests/smoke.test.cjs @@ -307,7 +307,7 @@ check('every installed undici copy is >= 6.28.1', () => { }); // --- Override floors (#128, #129) --- -// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got). +// http-cache-semantics: version-scoped to major 4, a single copy (@expo/ngrok > got). // postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline); // any other major is unexpected and must fail loudly. -- 2.45.2