Skip to content

fix(deps): resolve shell-quote and other npm audit vulnerabilities (MSDK-4134) #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
asadraza-usercentrics wants to merge 2 commits into
base: master
Choose a base branch
from
+85 −72
Open

fix(deps): resolve shell-quote and other npm audit vulnerabilities (MSDK-4134) #233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
245bf1a
fix(deps): override shell-quote to >=1.9.0 in sample app
asadraza-usercentrics Jul 24, 2026
dec9ab3
fix(deps): resolve npm audit vulnerabilities in root lockfile
asadraza-usercentrics Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
146 changes: 78 additions & 68 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions sample/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions sample/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,9 @@
"react-test-renderer": "19.1.0",
"typescript": "~5.3.0"
},
"overrides": {
"shell-quote": ">=1.9.0"
},
Comment on lines +63 to +65

@pantoaibot pantoaibot Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[CRITICAL_BUG] The npm "overrides" entry will be ignored if CI or contributors use an npm version that doesn't support overrides (or if Yarn/pnpm is used). If overrides are ignored the vulnerable shell-quote version remains in installs. Ensure the sample/ package-lock.json is regenerated with your package manager (e.g. run npm install/npm ci with an npm that supports overrides) and committed to the PR, and confirm with a reproducible check (e.g. npm ls shell-quote showing 1.10.0). Also verify CI runs using an npm version that supports overrides so the vulnerability is actually fixed in CI and downstream consumers.

Comment on lines +63 to +65

@pantoaibot pantoaibot Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[REFACTORING] Prefer pinning the override to the specific patched version you validated (for example "shell-quote": "1.10.0") instead of a loose range (">=1.9.0"). Pinning yields more deterministic installs and avoids accidental upgrades to a future version that may introduce regressions. If you intentionally want a range, document the reason in the PR message.

{
  "overrides": {
    "shell-quote": "1.10.0"
  }
}

Comment on lines +63 to +65

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package files =="
git ls-files | grep -E '(^|/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock)$' || true

echo
echo "== sample/package.json relevant lines =="
if [ -f sample/package.json ]; then
  nl -ba sample/package.json | sed -n '1,120p'
else
  echo "sample/package.json not found"
fi

echo
echo "== shell-quote references in lock/package files =="
if [ -f sample/package-lock.json ]; then
  echo "--- package-lock mentions ---"
  rg -n '"shell-quote"|1\.10\.0|1\.9\.0' sample/package-lock.json || true
fi
rg -n '"shell-quote"|1\.10\.0|1\.9\.0' package.json sample/package.json package-lock.json sample/package-lock.json 2>/dev/null || true

echo
echo "== changed files summary =="
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat origin/main..HEAD 2>/dev/null || git diff --stat 2>/dev/null | head -50

Repository: Usercentrics/react-native-sdk

Length of output: 346

🌐 Web query:

npm overrides semver ranges caret vs tilde documentation

💡 Result:

In npm, the overrides field in package.json supports the use of standard semver ranges, including caret (^) and tilde () specifiers [1][2]. The npm overrides feature is designed to allow developers to replace a package in their dependency tree with a specific version or range [3][4]. Because overrides accept any specifier that npm allows for dependencies, you are not restricted to exact versions [1][2]. Using caret or tilde ranges in overrides functions exactly as it does for standard dependencies [5][6]: Caret ranges (^): Allows changes that do not modify the left-most non-zero digit (e.g., ^1.2.3 allows minor and patch updates, such as 1.3.0, but not 2.0.0) [5][7][6]. Tilde ranges (): Allows patch-level changes if a minor version is specified, or minor-level changes if only the major version is specified (e.g., ~1.2.3 allows 1.2.4, but not 1.3.0) [5][7][6]. Example of using a range in an override: { "overrides": { "@npm/foo": "^1.0.0" } } Key considerations for npm overrides: - Overrides are only effective when placed in the root package.json file of a project [8][4][9]. - They are ignored if defined in the package.json of an installed dependency or a workspace, as they are intended for end-user applications rather than reusable libraries [8][4][9]. - If a dependency is subject to an override that falls outside its originally stated range, the override remains valid as long as the overridden version would have satisfied the original dependency requirement [8].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== sample/package.json relevant lines =="
awk 'NR>=1 && NR<=120 {printf "%6d  %s\n", NR, $0}' sample/package.json

echo
echo "== package-lock shell-quote locations =="
rg -n '"shell-quote"|shell-quote|1\.10\.0|1\.9\.0' package-lock.json sample/package-lock.json | sed -n '1,120p'

Repository: Usercentrics/react-native-sdk

Length of output: 4056

Bound the override to the locked minor version.

>=1.9.0 is open-ended across future major releases. Since sample/package-lock.json resolves shell-quote to 1.10.0, use ^1.10.0 to keep the intended range without allowing a major upgrade to 2.x.

Proposed fix 
   "overrides": {
-    "shell-quote": ">=1.9.0"
+    "shell-quote": "^1.10.0"
   },
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"overrides": {
"shell-quote": ">=1.9.0"
},
"overrides": {
"shell-quote": "^1.10.0"
},
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample/package.json` around lines 63 - 65, Update the shell-quote entry in
the overrides configuration from the open-ended >=1.9.0 range to ^1.10.0,
matching the locked 1.10.0 version while preventing upgrades to major version
2.x.

Source: Coding guidelines

"engines": {
"node": ">=20.19.4"
}
Expand Down
Loading