fix(deps): resolve shell-quote and other npm audit vulnerabilities (MSDK-4134) - #233
fix(deps): resolve shell-quote and other npm audit vulnerabilities (MSDK-4134)#233asadraza-usercentrics wants to merge 2 commits into
Conversation
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:M
📝 WalkthroughWalkthroughThe sample package configuration adds an override requiring ChangesDependency override
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoResolve npm audit vulnerabilities via shell-quote override + lockfile updates
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
|
PR Summary: Summary: Add an npm "overrides" entry in sample/package.json to force shell-quote >=1.9.0 to address npm-audit vulnerability (and related transitive dependency issues). Changes:
|
![pantoaibot[bot]](https://avatars.githubusercontent.com/in/934356?s=60&v=4){kind=small}
| "overrides": { | ||
| "shell-quote": ">=1.9.0" | ||
| }, |
There was a problem hiding this comment.
[CRITICAL_BUG] The npm "overrides" entry will be ignored if CI or contributors use an npm version that doesn't support overrides (or if Yarn/pnpm is used). If overrides are ignored the vulnerable shell-quote version remains in installs. Ensure the sample/ package-lock.json is regenerated with your package manager (e.g. run npm install/npm ci with an npm that supports overrides) and committed to the PR, and confirm with a reproducible check (e.g. npm ls shell-quote showing 1.10.0). Also verify CI runs using an npm version that supports overrides so the vulnerability is actually fixed in CI and downstream consumers.
| "overrides": { | ||
| "shell-quote": ">=1.9.0" | ||
| }, |
There was a problem hiding this comment.
[REFACTORING] Prefer pinning the override to the specific patched version you validated (for example "shell-quote": "1.10.0") instead of a loose range (">=1.9.0"). Pinning yields more deterministic installs and avoids accidental upgrades to a future version that may introduce regressions. If you intentionally want a range, document the reason in the PR message.
{
"overrides": {
"shell-quote": "1.10.0"
}
}
|
Reviewed up to commit:dec9ab36ba7ba5a41951facfb7455b236ea1a5a3 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@sample/package.json`:
- Around line 63-65: Update the shell-quote entry in the overrides configuration
from the open-ended >=1.9.0 range to ^1.10.0, matching the locked 1.10.0 version
while preventing upgrades to major version 2.x.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dcfba6cc-5244-46b9-ad7e-9a1e2e523fa5
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonsample/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
sample/package.json
| "overrides": { | ||
| "shell-quote": ">=1.9.0" | ||
| }, |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package files =="
git ls-files | grep -E '(^|/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$' || true
echo
echo "== sample/package.json relevant lines =="
if [ -f sample/package.json ]; then
nl -ba sample/package.json | sed -n '1,120p'
else
echo "sample/package.json not found"
fi
echo
echo "== shell-quote references in lock/package files =="
if [ -f sample/package-lock.json ]; then
echo "--- package-lock mentions ---"
rg -n '"shell-quote"|1\.10\.0|1\.9\.0' sample/package-lock.json || true
fi
rg -n '"shell-quote"|1\.10\.0|1\.9\.0' package.json sample/package.json package-lock.json sample/package-lock.json 2>/dev/null || true
echo
echo "== changed files summary =="
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat origin/main..HEAD 2>/dev/null || git diff --stat 2>/dev/null | head -50Repository: Usercentrics/react-native-sdk
Length of output: 346
🌐 Web query:
npm overrides semver ranges caret vs tilde documentation
💡 Result:
In npm, the overrides field in package.json supports the use of standard semver ranges, including caret (^) and tilde () specifiers [1][2]. The npm overrides feature is designed to allow developers to replace a package in their dependency tree with a specific version or range [3][4]. Because overrides accept any specifier that npm allows for dependencies, you are not restricted to exact versions [1][2]. Using caret or tilde ranges in overrides functions exactly as it does for standard dependencies [5][6]: Caret ranges (^): Allows changes that do not modify the left-most non-zero digit (e.g., ^1.2.3 allows minor and patch updates, such as 1.3.0, but not 2.0.0) [5][7][6]. Tilde ranges (): Allows patch-level changes if a minor version is specified, or minor-level changes if only the major version is specified (e.g., ~1.2.3 allows 1.2.4, but not 1.3.0) [5][7][6]. Example of using a range in an override: { "overrides": { "@npm/foo": "^1.0.0" } } Key considerations for npm overrides: - Overrides are only effective when placed in the root package.json file of a project [8][4][9]. - They are ignored if defined in the package.json of an installed dependency or a workspace, as they are intended for end-user applications rather than reusable libraries [8][4][9]. - If a dependency is subject to an override that falls outside its originally stated range, the override remains valid as long as the overridden version would have satisfied the original dependency requirement [8].
Citations:
- 1: https://docs.npmjs.com/cli/v11/configuring-npm/package-json/
- 2: https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-json.md
- 3: https://docs.npmjs.com/cli/v9/configuring-npm/package-json/
- 4: https://docs.npmjs.com/cli/v10/configuring-npm/package-json/
- 5: https://docs.npmjs.com/cli/v6/using-npm/semver/
- 6: https://www.npmjs.com/package/semver
- 7: https://github.com/npm/node-semver/blob/b30f2ce1f6adfe5c4f14eb69b034bc8a4c05b82a/README.md
- 8: https://github.com/npm/rfcs/blob/main/implemented/0036-overrides.md
- 9: Document that package.json overrides are not used when a package is installed as a dependency. npm/documentation#975
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== sample/package.json relevant lines =="
awk 'NR>=1 && NR<=120 {printf "%6d %s\n", NR, $0}' sample/package.json
echo
echo "== package-lock shell-quote locations =="
rg -n '"shell-quote"|shell-quote|1\.10\.0|1\.9\.0' package-lock.json sample/package-lock.json | sed -n '1,120p'Repository: Usercentrics/react-native-sdk
Length of output: 4056
Bound the override to the locked minor version.
>=1.9.0 is open-ended across future major releases. Since sample/package-lock.json resolves shell-quote to 1.10.0, use ^1.10.0 to keep the intended range without allowing a major upgrade to 2.x.
Proposed fix
"overrides": {
- "shell-quote": ">=1.9.0"
+ "shell-quote": "^1.10.0"
},📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "overrides": { | |
| "shell-quote": ">=1.9.0" | |
| }, | |
| "overrides": { | |
| "shell-quote": "^1.10.0" | |
| }, |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@sample/package.json` around lines 63 - 65, Update the shell-quote entry in
the overrides configuration from the open-ended >=1.9.0 range to ^1.10.0,
matching the locked 1.10.0 version while preventing upgrades to major version
2.x.
Source: Coding guidelines
Code Review by Qodo
1. Node 18 compatibility regression
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| "node_modules/brace-expansion": { | ||
| "version": "5.0.6", | ||
| "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", | ||
| "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", | ||
| "version": "5.0.8", | ||
| "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", | ||
| "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", | ||
| "dev": true, | ||
| "license": "MIT", | ||
| "dependencies": { | ||
| "balanced-match": "^4.0.2" | ||
| }, | ||
| "engines": { | ||
| "node": "18 || 20 || >=22" | ||
| "node": "20 || >=22" | ||
| } |
There was a problem hiding this comment.
1. Node 18 compatibility regression 🐞 Bug ☼ Reliability
The root lockfile now pins brace-expansion@5.0.8 with engines.node set to 20 || >=22, which contradicts the repo’s documented/support-script requirement of Node.js 18+ and can cause EBADENGINE warnings or hard install failures in environments that enforce engines. This effectively raises the minimum supported Node version (at least for dev tooling that depends on minimatch/brace-expansion) without updating the stated requirements.
Agent Prompt
## Issue description
`package-lock.json` now resolves `brace-expansion` to a version that declares Node `20 || >=22`, while the repo still claims Node 18+ support. This can break contributors and CI variants that use Node 18 (or any package manager/config with strict engine enforcement).
## Issue Context
- Lockfile now pins `brace-expansion@5.0.8` with `engines.node: "20 || >=22"`.
- The repo documentation and `check-requirements` script still treat Node 18 as supported.
## Fix Focus Areas
Choose one of these consistent paths:
1) **Keep Node 18 support**: add an override/resolution to force a Node-18-compatible `brace-expansion` version (and regenerate the lockfile), or adjust the dependency chain so a compatible version is selected.
2) **Drop Node 18 support intentionally**: update the documented minimum Node version everywhere (README, `scripts/check-requirements.sh`, and ideally add an explicit `engines.node` in root `package.json`) to reflect Node 20+.
References:
- package-lock.json[4571-4582]
- README.md[25-37]
- scripts/check-requirements.sh[80-86]
- package-lock.json[8706-8717]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
User description
Summary
fix(deps): override shell-quote to >=1.9.0 in sample app— resolves MSDK-4134(CVE-2026-9277 Critical + CVE-2026-13311 High in
sample/package.json's transitiveshell-quotedependency, via apackage.jsonoverride + lockfile regen, mirroringthe existing pattern from fix(MSDK-3374): resolve npm dependency vulnerabilities #202/MSDK-3374)
fix(deps): resolve npm audit vulnerabilities in root lockfile—npm audit fixatthe repo root, resolving unrelated pre-existing advisories (
body-parser,brace-expansion,joi,js-yaml,launch-editor, and a separate newershell-quoteDoS CVEGHSA-395f-4hp3-45gv), all via semver-compatible lockfilebumps — no
package.jsonranges changedTest plan
npm auditclean in bothsample/and root (0 vulnerabilities)npm ls shell-quote—1.10.0everywhere insample/, no1.8.3leftmasterforsample/— onlyshell-quoteversion/integrity changedcontent-type; no packages removed unexpectedlymaster(not a regression)CodeAnt-AI Description
Close security issues in sample and root dependency locks
What Changed
shell-quoteversion, removing the vulnerable older release from its installed packagesbody-parser,brace-expansion,js-yaml,joi,launch-editor, andshell-quoteImpact
✅ Fewer npm audit vulnerabilities✅ Safer sample app installs✅ Reduced exposure to dependency security advisories💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
shell-quote(1.9.0 or newer).