Skip to content

chore: upgrade vitest to 3.2.7 and re-review the advisory table #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Neziahtech merged 1 commit into from
Oct 23, 2026
Merged

chore: upgrade vitest to 3.2.7 and re-review the advisory table #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

- **Upgraded vitest to 3.2.7** (from 2.1.9). Config and APIs needed no
changes; the suite (86 tests), lint, typecheck, and the production build
all pass on it, and CI's Node 20 stays supported. This clears the old
Vitest-UI / Vite / tinypool advisories; the freshly reviewed advisory
table is in docs/security.md. ESLint stays on 8.57.1: `eslint-config-next`
for Next 14 does not accept ESLint 9, so the ESLint/Next majors move
together.

## [0.2.0] - 2026-10-23

## [0.2.0] - 2026-10-23

Self-custody: Nyx now creates and holds its own keys, so no browser
Expand Down
30 changes: 17 additions & 13 deletions docs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,21 +120,25 @@ component state as soon as encryption completes.
- Hardware-signer and multisetup support; the encrypted blob is the only
key-protection primitive.

## Reviewed advisories (2026-10-23)

`npm audit` currently reports advisories that cannot be fixed without majors
beyond the approved dependency set. Each was reviewed rather than ignored:

| Advisory (pkg) | Severity | Assessment |
| ------------------------------------------------------------------------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Image Optimizer DoS via `remotePatterns` (`next` 14.2.35) | critical | Not applicable — Nyx uses no `next/image` remote patterns and configures no `remotePatterns`; fixed upstream when Next 15 lands via Dependabot |
| `toml` prototype pollution / recursion (transitive via `@stellar/stellar-sdk`) | high | Not applicable on used paths — Nyx never calls federation/stellar.toml parsing; only Horizon reads and tx submission |
| Vitest UI server / Vite dev-server / tinypool / glob CLI issues | high–critical | Dev-only; Vitest UI is never started in CI or by users; upgrade to vitest 3 tracked by Dependabot |
| PostCSS stringify XSS | high | Dev-only build dependency; no untrusted CSS is processed |
## Reviewed advisories (re-checked 2026-10-23 after the vitest 3 upgrade)

`npm audit` reports advisories that cannot be fixed without majors beyond
the approved dependency set (Next 16 for the `next`/`postcss` chain,
Next 15 for the `glob` chain, vitest 5 for `@vitest/mocker` — and those
majors also require ESLint 9, which `eslint-config-next` for Next 14 does
not accept). Each was reviewed rather than ignored:

| Advisory (pkg) | Severity | Assessment |
| ------------------------------------------------------------------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Image Optimizer / Server Components DoS, RCEs, cache issues (`next` 14.2.35) | critical | Not applicable — Nyx configures no `remotePatterns` and no rewrites; fixes land only with Next 16 |
| `toml` prototype pollution / recursion (transitive via `@stellar/stellar-sdk`) | high | Not applicable on used paths — Nyx never calls federation/stellar.toml parsing; only Horizon reads and tx submission |
| `@vitest/mocker` path traversal / manual-mock injection (vitest 3.2.7) | moderate | Dev-only and unused — Nyx never uses `vi.mock` redirect/mocker APIs; CI only runs `vitest run`; the fix requires vitest 5 (Node ≥22) |
| `glob` CLI command injection (via `eslint-config-next` → `@next/eslint-plugin-next`) | high | Not applicable — the advisory is in the glob **CLI** entry point (`-c/--cmd`); no glob CLI is invoked; pinned to eslint 8 / Next 14, clears with Next 15 |
| PostCSS stringify XSS | high | Dev-only build dependency; no untrusted CSS is processed; clears only with Next 16 |

CI runs `npm audit --audit-level=high` as a **non-blocking advisory** step
until the Dependabot majors are merged, per the decision recorded in
CHANGELOG. The gate should be re-locked after each upgrade lands.
until the Next 15/16 major lands, per the decision recorded in CHANGELOG.
The gate should be re-locked after each upgrade chain completes.

## Open considerations (good contributions)

Expand Down
Loading
Loading