morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7700] fix(deps): resolve six Dependabot alerts across runtime and fixture dependencies #4620

New issue

Closed

opened 2026-10-31 00:51:26 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:51:26 +00:00

Owner

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7700

Before submitting

Searched open and closed issues for related Dependabot, fast-uri, certifi and qs reports; no matching report found.
Removed credentials and sensitive target data.

Area / interface / earliest failure stage

Setup, packaging, or upgrade / Package or setup / dependency resolution.

Observed behavior

Source/dependency-metadata finding: the default branch has six open Dependabot alerts across three packages:

#1, #2, #3, #4: runtime ajv@8.20.0 -> fast-uri@3.1.8; upstream patches all four URI interpretation advisories in 3.1.9.
#5: scripts/fixtures/http3-lab-requirements.txt pins certifi==2026.7.22, which contains affected emSign trust roots. Upstream recommends 2026.10.19 or later.
#6: development @stryker-mutator/core -> typed-rest-client -> qs@6.16.0; the existing package override pins this affected version. Fixed in 6.16.1.

Reproduction

Executed gh api repos/morluto/rea/dependabot/alerts?state=open and inspected the latest main package/lockfile and Python fixture requirements. Six open records match these versions. No application exploit reproduction has been performed at issue creation.

Expected behavior

Use the compatible patched dependency versions, retain reproducible resolution, and synchronize generated dependency inventories/notices. Verify affected real package behavior and existing REA workflows before integration.

Impact and scope

fast-uri is a runtime transitive dependency used by Ajv; the inspected REA HAR validator compiles fixed schemas. qs is development-only; no direct REA comma-array serialization call was found. The Python pin belongs to the isolated HTTP/3 capture lab, whose client explicitly uses a local CA. These facts narrow exposure but do not establish absence of all vulnerable paths.
NOT_ENOUGH_INFO: no demonstrated REA exploit, downstream deployment impact, or comparative performance measurements yet.

REA version

Source revision 40b9c03f99 (main at investigation).

Runtime and platform / target

Linux x86_64 source checkout; pinned Node 24.22.1/npm 11.16.0 are required for validation. Targets are actual published npm/Python dependencies and REA HAR/HTTP3 fixture workflows; no external target application is involved.

Relevant evidence

Official advisories: fast-uri, certifi, qs. Published npm 3.1.9/6.16.1 and non-yanked PyPI certifi 2026.10.19 artifacts were confirmed available.

Proposed resolution and validation

Update only these packages and owning metadata. Run bounded dependency installation, relevant existing tests, package/static checks, and authentic upstream-artifact probes; compare the same completed workflow before/after and report CPU, wall time and memory with limitations. Preserve historical verification evidence and explicitly label any unavailable real HTTP/3 VM coverage.

Originally created by @gensokyo-dev on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7700 ### Before submitting - [x] Searched open and closed issues for related Dependabot, fast-uri, certifi and qs reports; no matching report found. - [x] Removed credentials and sensitive target data. ### Area / interface / earliest failure stage Setup, packaging, or upgrade / Package or setup / dependency resolution. ### Observed behavior Source/dependency-metadata finding: the default branch has six open Dependabot alerts across three packages: - [#1](https://github.com/morluto/rea/security/dependabot/1), [#2](https://github.com/morluto/rea/security/dependabot/2), [#3](https://github.com/morluto/rea/security/dependabot/3), [#4](https://github.com/morluto/rea/security/dependabot/4): runtime `ajv@8.20.0 -> fast-uri@3.1.8`; upstream patches all four URI interpretation advisories in 3.1.9. - [#5](https://github.com/morluto/rea/security/dependabot/5): `scripts/fixtures/http3-lab-requirements.txt` pins `certifi==2026.7.22`, which contains affected emSign trust roots. Upstream recommends 2026.10.19 or later. - [#6](https://github.com/morluto/rea/security/dependabot/6): development `@stryker-mutator/core -> typed-rest-client -> qs@6.16.0`; the existing package override pins this affected version. Fixed in 6.16.1. ### Reproduction Executed `gh api repos/morluto/rea/dependabot/alerts?state=open` and inspected the latest main package/lockfile and Python fixture requirements. Six open records match these versions. No application exploit reproduction has been performed at issue creation. ### Expected behavior Use the compatible patched dependency versions, retain reproducible resolution, and synchronize generated dependency inventories/notices. Verify affected real package behavior and existing REA workflows before integration. ### Impact and scope `fast-uri` is a runtime transitive dependency used by Ajv; the inspected REA HAR validator compiles fixed schemas. `qs` is development-only; no direct REA comma-array serialization call was found. The Python pin belongs to the isolated HTTP/3 capture lab, whose client explicitly uses a local CA. These facts narrow exposure but do not establish absence of all vulnerable paths. NOT_ENOUGH_INFO: no demonstrated REA exploit, downstream deployment impact, or comparative performance measurements yet. ### REA version Source revision 40b9c03f996270e944ff07cafb63be15ce903708 (main at investigation). ### Runtime and platform / target Linux x86_64 source checkout; pinned Node 24.22.1/npm 11.16.0 are required for validation. Targets are actual published npm/Python dependencies and REA HAR/HTTP3 fixture workflows; no external target application is involved. ### Relevant evidence Official advisories: [fast-uri](https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr), [certifi](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2), [qs](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw). Published npm 3.1.9/6.16.1 and non-yanked PyPI certifi 2026.10.19 artifacts were confirmed available. ### Proposed resolution and validation Update only these packages and owning metadata. Run bounded dependency installation, relevant existing tests, package/static checks, and authentic upstream-artifact probes; compare the same completed workflow before/after and report CPU, wall time and memory with limitations. Preserve historical verification evidence and explicitly label any unavailable real HTTP/3 VM coverage.

bsakaguchi

2026-10-31 00:51:26 +00:00

closed this issue
added the
bug
label

bsakaguchi commented

2026-10-31 00:51:28 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 28, 2026):

Implemented the dependency changes on fix/7700-dependabot-dependencies; validation is in progress.

Executed against the actual published packages:

Probe	Original	Patched
`fast-uri.parse('%6Aavascript:alert(1)')`	decoded scheme `javascript`, no error	malformed-scheme error
`fast-uri.parse('http://a@b@evil.example/')`	silently rewrote host to `evil.example`	malformed-host error
`fast-uri.normalize('../x')`	`x`	`../x`
`fast-uri.serialize({scheme: 'placeholder', path: 'javascript:alert(1)'}, {reference: 'suffix'})`	`javascript:alert(1)`	`javascript%3Aalert(1)`
`qs.stringify({a: [{toString: 'x'}]}, {arrayFormat: 'comma'})` (also `encodeValuesOnly: true`)	throws `TypeError`	returns `a=%5Bobject%20Object%5D`
certifi affected emSign ECC G3 root	present (121 total roots)	absent (120 total roots)

The original fast-uri archive and new runtime license archive were checked against lockfile SHA-512 integrity and package identity. The license text is unchanged; inventory and runtime fingerprint are synchronized. The lockfile changes exactly two package entries.

npm audit reports zero vulnerabilities. Python pip check, five real local QUIC/TLS handshakes using the fixture configuration, and both existing HTTP/3 fixture lifecycle tests pass on CPython 3.11.2. This is not the sealed CPython 3.14.7 HTTP/3 VM lane; that verification gap is now explicit in the requirements comments and lab guide.

Real Chromium 156.0.8078.47 captured a local HTTP application: 65 HAR records / 124,348 bytes. Three fresh CLI invocations and four calls on one MCP session returned identical normalized results before/after, with only the requested record returned. Isolated performance checks and remaining repository checks are still running; no speedup claim is made.

@gensokyo-dev commented on GitHub (Oct 28, 2026): Implemented the dependency changes on `fix/7700-dependabot-dependencies`; validation is in progress. Executed against the actual published packages: | Probe | Original | Patched | | --- | --- | --- | | `fast-uri.parse('%6Aavascript:alert(1)')` | decoded scheme `javascript`, no error | malformed-scheme error | | `fast-uri.parse('http://a@b@evil.example/')` | silently rewrote host to `evil.example` | malformed-host error | | `fast-uri.normalize('../x')` | `x` | `../x` | | `fast-uri.serialize({scheme: 'placeholder', path: 'javascript:alert(1)'}, {reference: 'suffix'})` | `javascript:alert(1)` | `javascript%3Aalert(1)` | | `qs.stringify({a: [{toString: 'x'}]}, {arrayFormat: 'comma'})` (also `encodeValuesOnly: true`) | throws `TypeError` | returns `a=%5Bobject%20Object%5D` | | certifi affected emSign ECC G3 root | present (121 total roots) | absent (120 total roots) | The original fast-uri archive and new runtime license archive were checked against lockfile SHA-512 integrity and package identity. The license text is unchanged; inventory and runtime fingerprint are synchronized. The lockfile changes exactly two package entries. `npm audit` reports zero vulnerabilities. Python `pip check`, five real local QUIC/TLS handshakes using the fixture configuration, and both existing HTTP/3 fixture lifecycle tests pass on CPython 3.11.2. This is not the sealed CPython 3.14.7 HTTP/3 VM lane; that verification gap is now explicit in the requirements comments and lab guide. Real Chromium 156.0.8078.47 captured a local HTTP application: 65 HAR records / 124,348 bytes. Three fresh CLI invocations and four calls on one MCP session returned identical normalized results before/after, with only the requested record returned. Isolated performance checks and remaining repository checks are still running; no speedup claim is made.

bsakaguchi commented

2026-10-31 00:51:28 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 28, 2026):

Local validation is complete; implementation PR: #7704.

Node 24.22.1 / npm 11.16.0: clean install, all static checks (npm run check), build, documentation/license checks and npm audit (0 vulnerabilities) passed.
103 HAR source regressions passed. Two CLI/MCP boundary tests passed when isolated with a 120s per-test timeout / one worker; the default 30s runs timed out under the 2-CPU resource cap. No semantic assertions were changed.
Python trust-store inspection, five actual local QUIC/TLS handshakes, pip check and both fixture lifecycle tests passed. Full sealed HTTP/3 VM replay remains unavailable and is explicitly documented.
Full verify:package passed in a private user/PID namespace, including extracted plugin tools and final process-lineage cleanup. The normal host run was stopped by an EACCES ownership-audit limitation, not silently treated as passing. npm pack --dry-run passed.
Authentic Chromium HAR: 65 records / 124,348 bytes; normalized CLI/MCP results are identical and return only the requested record. Controlled runtime A/B: 24.00 → 24.86 s elapsed, 19.06 → 19.94 CPU-s, 475.9 → 474.4 MiB sampled process-family RSS sum. Each CLI response remains 10,135 bytes / ~3,046 tokenx-estimated tokens. Single shared-host sample, OS caches not flushed; no speedup claim and no whole-agent/schema token measurement.
Greptile review: 5/5, no actionable findings. Codex review was unavailable due to repository quota. Remote CI is still running; no merge or closed-alert claim yet.

@gensokyo-dev commented on GitHub (Oct 28, 2026): Local validation is complete; implementation PR: #7704. - Node 24.22.1 / npm 11.16.0: clean install, all static checks (`npm run check`), build, documentation/license checks and npm audit (0 vulnerabilities) passed. - 103 HAR source regressions passed. Two CLI/MCP boundary tests passed when isolated with a 120s per-test timeout / one worker; the default 30s runs timed out under the 2-CPU resource cap. No semantic assertions were changed. - Python trust-store inspection, five actual local QUIC/TLS handshakes, `pip check` and both fixture lifecycle tests passed. Full sealed HTTP/3 VM replay remains unavailable and is explicitly documented. - Full `verify:package` passed in a private user/PID namespace, including extracted plugin tools and final process-lineage cleanup. The normal host run was stopped by an EACCES ownership-audit limitation, not silently treated as passing. `npm pack --dry-run` passed. - Authentic Chromium HAR: 65 records / 124,348 bytes; normalized CLI/MCP results are identical and return only the requested record. Controlled runtime A/B: 24.00 → 24.86 s elapsed, 19.06 → 19.94 CPU-s, 475.9 → 474.4 MiB sampled process-family RSS sum. Each CLI response remains 10,135 bytes / ~3,046 tokenx-estimated tokens. Single shared-host sample, OS caches not flushed; no speedup claim and no whole-agent/schema token measurement. - Greptile review: 5/5, no actionable findings. Codex review was unavailable due to repository quota. Remote CI is still running; no merge or closed-alert claim yet.

bsakaguchi commented

2026-10-31 00:51:28 +00:00

Author

Owner

@gensokyo-dev commented on GitHub (Oct 28, 2026):

Resolved by #7704, merged as e556134302 by gensokyo-dev. All required code checks passed, including all eight test shards and the cross-platform package/native lanes; Greptile reported no actionable findings. GitHub now marks Dependabot alerts #1–6 as fixed (2026-10-28 03:36:45–46 UTC), with zero open alerts. Verified main pins: fast-uri 3.1.9, qs 6.16.1, certifi 2026.10.19. Validation details, performance measurements and unavailable coverage remain in the PR body.

@gensokyo-dev commented on GitHub (Oct 28, 2026): Resolved by #7704, merged as e556134302f055936c0295838d72ebcd5454bc96 by gensokyo-dev. All required code checks passed, including all eight test shards and the cross-platform package/native lanes; Greptile reported no actionable findings. GitHub now marks Dependabot alerts #1–6 as fixed (2026-10-28 03:36:45–46 UTC), with zero open alerts. Verified main pins: fast-uri 3.1.9, qs 6.16.1, certifi 2026.10.19. Validation details, performance measurements and unavailable coverage remain in the PR body.

bsakaguchi referenced this issue

2026-11-01 21:42:54 +00:00

[PR #5067] [CLOSED] docs(gemini): diagnose model schema rejection separately from MCP setup #6766

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4620

No description provided.

Rows
Columns