Repository navigation
chore(deps): remediate docs runtime dependency advisories - #206
Merged
truthixify merged 1 commit intoOct 19, 2026
Conversation
The production audit reported 9 high and 9 moderate advisories, all reachable through the Stellar and Solana SDK paths used by the executable docs tooling. - Bump @solana/web3.js to ^1.99.0 and @stellar/stellar-sdk to ^13.3.0. - Add pnpm overrides to pull axios (>=1.20.0), toml (^4.2.0) and uuid (^11.1.1) up to their patched releases. This clears all 9 high findings and 6 of the 9 moderate ones. - Record the three stream-json advisories in pnpm.auditConfig.ignoreGhsas: patched releases are ESM-only and drop the subpaths jayson@4 requires, and the vulnerable code paths (filters, JSONC, Assembler) are unused. - Add the Dependency audit workflow and DEPENDENCY-POLICY.md so a new high or critical advisory on a production dependency path fails the build.
|
@Pythagoras-x Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
truthixify
approved these changes
Oct 19, 2026
truthixify
left a comment
truthixify
left a comment
Contributor
There was a problem hiding this comment.
Reviewed exact head 4d3a53b. The production dependency audit is clean at the enforced severity, the dependency policy and workflow are scoped appropriately, the complete docs test suite passes, and all required checks are green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #196
What
Remediate the 9 high and 9 moderate advisories reported by the production audit on the Stellar and Solana SDK dependency paths, and add an enforced policy for new high findings.
Changes
package.json):@solana/web3.js^1.95.0→^1.99.0@stellar/stellar-sdk^13.1.0→^13.3.0pnpm.overridesto lift transitive deps to their patched releases:axios@<1.20.0→>=1.20.0(clears 7 high + 5 moderate, Stellar path)toml@<4.2.0→^4.2.0(clears 2 high, Stellar path)uuid@<11.1.1→^11.1.1(clears 1 moderate, Solana path)pnpm.auditConfig.ignoreGhsasrecords the three remainingstream-jsonmoderates. Patched releases (>=3.6.0) are ESM-only and no longer expose thestream-json/streamers/StreamValuesandstream-json/utils/Verifiersubpaths thatjayson@4require()s, so there is no compatible fix; the vulnerable code paths (filters, JSONC, Assembler) are unused by the Solana RPC client.pnpm-lock.yaml).DEPENDENCY-POLICY.md— rules for high/critical (block merge) and for allowlisting unfixable moderates..github/workflows/dependency-audit.yml— runspnpm audit --prod --audit-level highon PRs, on push todevelop/main, and weekly against the live advisory DB.Audit result
Verification
All snippet and playground suites pass:
pnpm test(snippets, nav coverage, contract registry, compatibility matrix, redirects/anchors)pnpm run check:api-examplespnpm run check:snippets-extended(Rust / Python / shell / config, incl. the offline Python quickstart)pnpm run check:playground-fixtures+pnpm run test:playgroundpnpm run check:stellar-testnetpnpm install --frozen-lockfileAlso verified the overrides resolve at runtime:
@stellar/stellar-sdkloadstoml@4.3.0, andjayson/@solana/web3.jsloaduuid@11.1.1.