Conversation
- Pin xml2js via overrides (CVE-2023-0842) - Bump js-yaml to 3.14.2; override follow-redirects to 1.16.0 - Run Snyk workflow weekly on Mondays (UTC)
There was a problem hiding this comment.
Pull request overview
This PR aims to reduce known npm supply-chain vulnerabilities in the docker/client/rundeck-cli image via dependency pinning/overrides, and adds a weekly scheduled Snyk scan to complement existing CI triggers.
Changes:
- Bump direct dependency
js-yamlto^3.14.2. - Add/adjust npm
overridesto pin transitive dependencies (e.g.,follow-redirects,xml2js) and update the lockfile accordingly. - Add a weekly GitHub Actions schedule (Mondays 06:00 UTC) for the reusable Snyk scan workflow.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
docker/client/rundeck-cli/package.json |
Updates js-yaml and adds new npm overrides intended to mitigate transitive CVEs. |
docker/client/rundeck-cli/package-lock.json |
Reflects resolved versions for the updated pins (e.g., follow-redirects, js-yaml, xml2js). |
.github/workflows/snyk-scan.yml |
Adds a weekly cron trigger for Snyk scanning. |
Files not reviewed (1)
- docker/client/rundeck-cli/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "follow-redirects": "1.16.0", | ||
| "tough-cookie": "4.1.3", | ||
| "xml-js": "0.5.1", | ||
| "xml2js": "0.6.2", |
There was a problem hiding this comment.
The overrides force major/semver-incompatible versions for transitive deps (e.g., ts-rundeck / @azure/ms-rest-js declare axios: ^0.18.0, tough-cookie: ^2.4.3, xml2js: ^0.4.19, but overrides pin axios@1.15.0, tough-cookie@4.1.3, xml2js@0.6.2). This bypasses the dependents’ declared compatibility ranges and can cause runtime breakage. Prefer upgrading/replacing the upstream dependency to versions that support the newer transitive deps, or scope overrides as narrowly as possible and add a smoke check to validate the CLI still works with the forced versions.
| "xml2js": "0.6.2", |
fdevans
changed the title
|
Team Note: BouncyCastle findings will be handled by a different ticket/project |
Summary
overrides(xml2js0.6.2 for CVE-2023-0842), bump directjs-yamlto ^3.14.2, and pinfollow-redirectsto 1.16.0 for the axios chain.PR Details
Gradle/Bouncy Castle and
net.i2p.crypto:eddsaare unchanged; BC remains on 1.79 per org constraints.