build(deps): override adm-zip to ^0.6.0 to clear GHSA-xcpc-8h2w-3j85#56
Merged
Conversation
Dependabot alert #9 (high): a crafted ZIP makes adm-zip < 0.6.0 allocate 4GB. The extension resolved adm-zip 0.5.16 transitively. Dependabot could not open a PR because there is no upstream fix to bump to: web-ext@10.5.0 (latest) └─ firefox-profile@4.7.0 (latest) └─ adm-zip "~0.5.x" ← cannot reach the patched 0.6.0 The range is pinned to 0.5.x, so the only way to take the patch today is an override. Reachability is narrow either way — adm-zip is devDependencies-only and never ships in dist/, and of firefox-profile's two call sites only addExtension() parses an untrusted archive (`new AdmZip(xpi)`), which needs `web-ext run` with a hostile .xpi. CI only runs `web-ext lint`. So this is hygiene, not an incident. Verified with npm 10 (CI is Node 20) that the override resolves and the dependent still works: npm ci adm-zip 0.6.0 firefox_profile.encoded() OK, zip roundtrip readable addExtension(.xpi) OK (the AdmZip(path)+extractAllTo path) npm run build OK node build.js validate OK, chrome + firefox node test-extension.js OK web-ext lint exit 0, 0 errors (3 pre-existing warnings) Drop the override once firefox-profile widens its range. Co-Authored-By: Claude <noreply@anthropic.com>
This was referenced Jul 20, 2026
aaronjmars
added a commit
that referenced
this pull request
Jul 20, 2026
…changes (#57) * docs: add a changelog and a release checklist that surfaces breaking changes #55 made `--tunnel` require a bearer token on /sse. That is a real break for anyone running a tunnelled connector today — it will present as "my ChatGPT connector stopped working" the moment they upgrade — and right now nothing in the repo would remind us to say so at tag time. Release notes are hand-written per release, and `.github/workflows/publish.yml` pushes to npm on a `v*` tag, so the tag is the point of no return. Add `.github/CHANGELOG.md`, seeded with an Unreleased section covering everything landed since v1.1.1 (13 commits): the tunnel token under⚠️ Breaking with the migration line spelled out, the three security fixes (#53, #55, #56), the node-forge/brace-expansion bump (#43), and the dependency and docs maintenance. Add a Releasing section to CONTRIBUTING that makes reading Unreleased step 1 of cutting a tag, and states that a⚠️ Breaking entry means a major bump with the migration step at the top of the release notes. Also ask PR authors to add their own entry, so the file stays accurate instead of being reconstructed later. No code changes. Co-Authored-By: Claude <noreply@anthropic.com> * docs: link the adm-zip override to its removal issue (#58) --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot alert #9 (high): a crafted ZIP makes adm-zip < 0.6.0 allocate 4GB.
The extension resolved adm-zip 0.5.16 transitively.
Dependabot could not open a PR because there is no upstream fix to bump to:
web-ext@10.5.0 (latest)
└─ firefox-profile@4.7.0 (latest)
└─ adm-zip "~0.5.x" ← cannot reach the patched 0.6.0
The range is pinned to 0.5.x, so the only way to take the patch today is an
override. Reachability is narrow either way — adm-zip is devDependencies-only
and never ships in dist/, and of firefox-profile's two call sites only
addExtension() parses an untrusted archive (
new AdmZip(xpi)), which needsweb-ext runwith a hostile .xpi. CI only runsweb-ext lint. So this ishygiene, not an incident.
Verified with npm 10 (CI is Node 20) that the override resolves and the
dependent still works:
npm ci adm-zip 0.6.0
firefox_profile.encoded() OK, zip roundtrip readable
addExtension(.xpi) OK (the AdmZip(path)+extractAllTo path)
npm run build OK
node build.js validate OK, chrome + firefox
node test-extension.js OK
web-ext lint exit 0, 0 errors (3 pre-existing warnings)
Drop the override once firefox-profile widens its range.
Co-Authored-By: Claude noreply@anthropic.com