PL-916 [Vanta] Remediate High vulnerabilities identified in packages are addressed (GitHub Repo)

[anush]

Clears every open high-severity Dependabot alert (16/16) on xola/express-rate-limit, plus both open critical alerts, using lockfile + overrides changes only. No source-code edits, no direct-dependency major bumps.

All 16 alerts are development scope — this package ships only lib/ and has an empty dependencies block, so none of these reach consumers at runtime. They still need clearing for the Vanta control.

Packages upgraded

Package	From	To	How	Alerts cleared
express (direct devDep)	4.17.1	4.22.2	manifest ^4.17.1 → ^4.22.2 (in-major)	express-rate-limit#32 body-parser GHSA-qwcr-r2fm-qrc7, express-rate-limit#19 qs GHSA-hrpp-h998-j3pp
mocha (direct devDep)	7.1.1	7.2.0	manifest ^7.1.1 → ^7.2.0 (in-major)	— (enables clean re-resolve)
body-parser	1.19.0	1.20.6	via express	express-rate-limit#32
qs	6.5.2, 6.7.0	6.15.3	via express + qs@<6.5.3 override	express-rate-limit#19, #10
path-to-regexp	0.1.7	0.1.13	via express	GHSA-37ch-88jc-xwx2, GHSA-9wv6-86v2-598j, GHSA-rhx6-c78j-4q9w (high, not yet alerted)
ansi-regex	3.0.0 / 4.1.0 / 5.0.0	3.0.1 / 4.1.1 / 5.0.1	per-major overrides	express-rate-limit#18, express-rate-limit#17, #16 GHSA-93q8-gq69-wqmw
brace-expansion	1.1.11	1.1.16	brace-expansion@1 override	express-rate-limit#75 GHSA-3jxr-9vmj-r5cp
braces	3.0.2	3.0.3	override	express-rate-limit#29 GHSA-grv7-fg5c-xmjg
flatted	2.0.1	3.4.3	override	express-rate-limit#62 GHSA-rf6f-7fwh-wjgh (+ GHSA-25h7-pfq9-p65f)
form-data	2.3.3	2.5.6	form-data@2 override	express-rate-limit#72 GHSA-hmw2-7cc7-3qxx, express-rate-limit#41 critical GHSA-fjxv-7rqg-78g4
js-yaml	3.13.1	3.15.0	js-yaml@3 override	express-rate-limit#76 GHSA-52cp-r559-cp3m
lodash	4.17.20	4.18.1	override	express-rate-limit#69 GHSA-r5fr-rjxr-66jc, #2 GHSA-35jh-r3h4-6jhm
minimatch	3.0.4	3.1.5	minimatch@3 override	express-rate-limit#60 GHSA-7r86-cg39-jmmj (+ 3 more)
tmp	0.0.33	0.2.7	override	express-rate-limit#71 GHSA-ph9p-34f9-6g65
y18n	4.0.0	4.0.1	y18n@4 override	#1 GHSA-c4w7-xm78-47vh
minimist	1.2.5	1.2.8	minimist@1 override	#14 critical GHSA-xvch-5gv4-984h
cross-spawn	6.0.5 / 7.0.1	6.0.6 / 7.0.6	per-major overrides	GHSA-3xgq-45jj-v275 (high, not yet alerted)
glob-parent	5.1.0	5.1.2	glob-parent@5 override	GHSA-ww39-953v-wcq6 (high, not yet alerted)
picomatch	2.2.2	2.3.2	picomatch@2 override	GHSA-c2c7-rcm5-vvqj (high, not yet alerted)
semver	5.7.0 / 6.3.0	5.7.2 / 6.3.1	per-major overrides	GHSA-c2qf-rxjj-qqgw (high, not yet alerted)
semver-regex	2.0.0	3.1.4	override	GHSA-44c6-4v22-4mhx (high, not yet alerted)

The last six rows are advisories the npm registry reports against this tree that Dependabot has not opened alerts for yet. Pinning them now costs nothing and stops the Vanta control from re-failing next time Dependabot rescans.

Notes on version choices:

• lodash 4.18.1, not the advisory's first_patched_version 4.18.0 — 4.18.0 is npm-deprecated ("Bad release").
• tmp 0.2.7, not 0.2.6 — 0.2.6 is still covered by a later advisory.
• minimatch 3.1.5, not 3.1.3 — 3.1.3/3.1.4 are still covered by GHSA-23c5-xmqv-rm74.

Lockfile format

package-lock.json is regenerated from v1 to v2 (v2 keeps the legacy dependencies block, so npm 6 can still read it — .travis.yml still lists node_js: 10). v3 was not used for that reason.

Residual

1 residual advisory on the whole tree, high severity:

Advisory	Package	Why it stays
GHSA-mh99-v99m-4gvg	brace-expansion (1.1.16)	Affects all published versions ≤ 5.0.7. The only version outside the range, 5.0.8, requires Node ≥ 20 and breaks minimatch@3 (TypeError: expand is not a function) — minimatch@3 is what pulls brace-expansion in here, via glob@7 under eslint/mocha. No usable patch exists. Not currently an open Dependabot alert.

No Dependabot alert of any severity is left open for a package we could patch; the open low/medium alerts on cookie, express, send, serve-static, qs, ajv, js-yaml, lodash, picomatch, tmp were out of scope for this change but most are incidentally cleared by the same bumps.

Behavioural caveats + smoke tests for the reviewer

Three overrides cross a major on a transitive dependency. Each was runtime-smoke-tested against the API its actual consumer uses:

1. flatted 2 → 3 (consumer: eslint → file-entry-cache → flat-cache@2).
   npx eslint . --cache twice in a row (cold write, then warm read) — ESLint: No issues found, exit 0 both times.
2. tmp 0.0.33 → 0.2.7 (consumer: eslint → inquirer → external-editor@3.1.0; also drops os-tmpdir).

   node -e "const {ExternalEditor}=require('external-editor');const e=new ExternalEditor('hello world');
            const fs=require('fs');console.log(fs.readFileSync(e.tempFile,'utf8'));e.cleanup();
            console.log('cleaned:', !fs.existsSync(e.tempFile));"
   

   → writes hello world, cleaned: true.
3. semver-regex 2 → 3 (consumer: husky@4 → find-versions@3.2.0).
   node -e "console.log(require('find-versions')('git version 2.43.0'))" → [ '2.43.0' ].
   husky's install hook also ran clean during npm ci.

Also smoke-tested: form-data@2.5.6 under supertest/superagent (multipart .field() POST → 200), and pretty-quick --check (exercises cross-spawn@7 via execa) → Everything is awesome!.

tmp@0.2.7 declares engines: node >=14.14. It is dev-only and every other pin here stays compatible with the repo's oldest declared CI target; npm ci produced zero EBADENGINE warnings and npm ls --all reports zero invalid/unmet peers.

Verification

Baseline = origin/master at dbe0cd0, run identically before and after. Node v22.22.0, npm 10.9.4.

Check	Command	Baseline (master)	This branch
install	npm ci --no-audit --no-fund	pass, 341 packages	pass, 358 packages
lint	npx eslint .	pass — ESLint: No issues found	pass — ESLint: No issues found
test	npx mocha	pass — 37 passing	pass — 37 passing
build	n/a	no build script	no build script
tree health	npm ls --all	clean	clean (0 invalid / 0 EBADENGINE)

npm test = npm run lint && mocha; both halves were run separately and both pass.

npm audit is unusable right now, on master as well as this branch — npm is retiring /-/npm/v1/security/audits/quick and it now returns an undeclared-gzip body that the client cannot parse (npm error audit endpoint returned an error). Evidence below uses two things that do work:

1. Semver proof (the primary evidence). For each of the 16 open high alerts, every resolved version of that package in the lockfile is tested against the alert's vulnerable_version_range with semver.satisfies. Run against the baseline lockfile as a control:

BASELINE vulnerable alerts: 16/16
HEAD     vulnerable alerts:  0/16

The baseline reporting 16/16 confirms the checker actually matches — a vacuous pass would show 0/16 on both sides.

2. npm bulk advisory endpoint (/-/npm/v1/security/advisories/bulk) over the whole flattened tree, baseline vs. branch, counting distinct advisory-package pairs at high/critical:

BASE: 33 high/critical advisory-package pairs
HEAD:  1 high/critical advisory-package pair

FIXED (32) ... NEWLY INTRODUCED (0) ... REMAINING (1: brace-expansion GHSA-mh99-v99m-4gvg)

3. Drift audit. 73 packages changed resolution. Every one is attributable to either (a) the express 4.17.1 → 4.22.2 sub-tree, (b) mocha 7.1.1 → 7.2.0, or (c) an explicit override target plus its own direct requirements. Nothing floated untargeted; the single removal (os-tmpdir) is a dependency of tmp@0.0.33 that tmp@0.2.7 no longer needs.

Fixes: https://app.vanta.com/c/xola.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated development tooling versions.
  • Applied security and stability updates to supporting packages.
  • Standardized versions for several transitive dependencies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e95149c1-ef50-46a9-98b2-68ef066f9a33

📥 Commits

Reviewing files that changed from the base of the PR and between dbe0cd0 and 7c0432f.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• xola/x2-seller (manual) → reviewed against open PR #6794 vanta/dependabot-high-2026-07-24 instead of the default branch
• xola/x2-checkout (manual)

📜 Recent review details

🔇 Additional comments (3)

package.json (3)

39-45: LGTM!

---

46-67: 🔒 Security & Privacy

Verify npm 6 cannot bypass these security overrides.

npm 6 does not interpret overrides; the v2 lockfile can preserve the resolved versions only when it is consumed unchanged. Since npm 6 compatibility is an objective, verify CI performs a clean npm 6 install from the committed lockfile, or require a package-manager version that supports overrides.

---

50-50: 🔒 Security & Privacy

Confirm the remaining brace-expansion advisory is development-only.

This override intentionally retains 1.1.16, while the PR objective acknowledges a remaining high-severity advisory. Verify that brace-expansion is absent from the production dependency graph and document the accepted exception; otherwise the release still ships a known high-severity dependency.

---

📝 Walkthrough

Walkthrough

package.json updates the development versions of express and mocha, and adds npm overrides for multiple transitive dependencies.

Changes

Dependency manifest updates

Layer / File(s)	Summary
Development dependency and override configuration package.json	Development versions of express and mocha are bumped, and a top-level overrides block pins multiple transitive dependency versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• xola/mailer#21: Updates Express and development tooling while adding transitive dependency overrides.
• xola/xolabot-xwm#20: Adds package overrides for overlapping transitive dependencies.
• xola/base-nextjs-template#6: Adds overlapping npm override pins for transitive packages.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: Unexpected token :

---

_{Comment @coderabbitai help to get the list of available commands.}