Security: Fix serialize-javascript vulnerability (CVE-2020-7660) - #157
Conversation
- Update mocha from ^10.0.0 to ^11.0.0 - Add npm override to force serialize-javascript@^7.0.5 - Update Node.js requirement to >=18.18.0 for compatibility - Resolves code injection vulnerability in serialize-javascript <= 7.0.2 - Verified: npm audit no longer reports serialize-javascript issues The serialize-javascript package had a code injection vulnerability where attackers could inject malicious code via RegExp.flags or Date.toISOString(). This fix ensures we use serialize-javascript@7.0.5+ which patches the issue. Breaking change: Requires Node.js >=18.18.0
There was a problem hiding this comment.
Pull request overview
This PR addresses CVE-2020-7660 exposure via serialize-javascript by upgrading test tooling and enforcing a patched transitive dependency version, alongside raising the minimum supported Node.js version for compatibility.
Changes:
- Bump Node.js engine requirement to
>=18.18.0. - Upgrade
mochato^11.0.0and add an npmoverridesrule to forceserialize-javascript@^7.0.5. - Add
SECURITY_FIX.mddocumenting the vulnerability, mitigation, and verification steps.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| package.json | Updates Node engine + Mocha and adds npm override for patched serialize-javascript. |
| SECURITY_FIX.md | Documents the CVE, the dependency strategy (Mocha + override), and verification guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ### Result | ||
| - ✅ serialize-javascript vulnerability resolved (7.0.5 installed) | ||
| - ✅ npm audit no longer shows serialize-javascript vulnerability | ||
| - ⚠️ Node.js >=18.18.0 now required | ||
|
|
||
| ## Verification | ||
| ```bash | ||
| npm ls serialize-javascript | ||
| # Shows: serialize-javascript@7.0.5 | ||
|
|
||
| npm audit | ||
| # No longer reports serialize-javascript vulnerability | ||
| ``` |
There was a problem hiding this comment.
The doc claims serialize-javascript@7.0.5 is installed, but package.json uses an override range (^7.0.5), so the installed version may be newer than 7.0.5. To keep this doc accurate over time, describe it as >=7.0.5 (or “7.0.5+”) and/or show an example output rather than an exact version.
| ## Compatibility | ||
| This fix requires Node.js >=18.18.0. Projects using older Node.js versions will need to upgrade. | ||
|
|
||
| For production deployments, ensure Node.js version meets the new requirement. No newline at end of file |
There was a problem hiding this comment.
Since this PR raises the minimum Node.js version to >=18.18.0, please also update other repo-facing docs/config that still reference Node 14 (e.g., README system requirements) and CI/release workflows that pin or matrix-test Node 14/16. Otherwise consumers and CI will be out of sync with package.json engines.
| For production deployments, ensure Node.js version meets the new requirement. | |
| For production deployments, ensure the Node.js version is >=18.18.0. |
| "xmlbuilder": "^12.0.1" | ||
| }, | ||
| "overrides": { | ||
| "serialize-javascript": "^7.0.5" |
There was a problem hiding this comment.
The overrides entry forces serialize-javascript to a major version (7.x) outside Mocha’s declared range (^6.0.2). To reduce unintended side effects and make the intent clearer, scope the override to the dependency chain that needs it (e.g., mocha > serialize-javascript) instead of applying it globally.
| "serialize-javascript": "^7.0.5" | |
| "mocha": { | |
| "serialize-javascript": "^7.0.5" | |
| } |
| "engines": { | ||
| "node": ">=14.20.0" | ||
| "node": ">=18.18.0" | ||
| }, |
There was a problem hiding this comment.
Now that engines.node is >=18.18.0, the project is still type-checking against @types/node 14.x. This can lead to inaccurate typings and missed/incorrect Node API definitions. Consider upgrading @types/node (and TypeScript if required) to align with the supported runtime.
| "@types/xmlbuilder": "^0.0.32", | ||
| "chai": "~4.2.0", | ||
| "mocha": "^10.0.0", | ||
| "mocha": "^11.0.0", |
There was a problem hiding this comment.
Mocha was upgraded to v11, but @types/mocha remains pinned at ^8.2.2. This mismatch can cause TS type drift for tests (missing/incorrect typings). Please update @types/mocha to a version compatible with Mocha 11 (or document why it must remain on v8).
The serialize-javascript package had a code injection vulnerability where attackers could inject malicious code via RegExp.flags or Date.toISOString(). This fix ensures we use serialize-javascript@7.0.5+ which patches the issue.
Breaking change: Requires Node.js >=18.18.0