fix(deps): override fflate to 0.8.3, fixing a ZIP64-parsing DoS by qnbs · Pull Request #595 · qnbs/WorldScript-Studio

qnbs · 2026-09-03T15:31:15Z

Summary

fflate through 0.8.2 hangs in an infinite loop inside unzipSync() when parsing a crafted ZIP archive whose central directory declares the ZIP64 compressed_size sentinel (0xFFFFFFFF) but omits the required ZIP64 extra field — z64e() reads out of bounds, the result coerces to 0, and the loop condition never becomes false. CVSS 6.6 (GitHub Reviewed, CVSS v4; the same advisory's older CVSS v3.1 vector scores 7.5 — GitHub's live "Moderate" severity classification uses the v4 score as canonical), GHSA-px8p-9vwx-vf98 / CVE-2026-45820.

Transitive via jspdf (already pinned to the latest 4.2.1, which already declares "fflate": "^0.8.1" — a range 0.8.3 already satisfies, so no jspdf bump was needed, just forcing pnpm's resolution to the patched version already within range via pnpm.overrides).

Not caused by any recent change here — the advisory was only elevated to GitHub-reviewed status today (2026-09-03T14:58:12Z, confirmed via the GitHub Advisories API). Main's own Security Audit job passed clean two hours before this run first caught it; it started blocking every PR (including an unrelated governance-config PR, #586) the moment the advisory went live.

Test plan

pnpm why fflate → resolves to 0.8.3
pnpm audit --audit-level=high → the fflate finding is gone; only the pre-existing, already-documented extract-zip advisory (no fix available, transitive Playwright browser download, no runtime footprint) remains
pnpm run lint / pnpm run ci:prepush — clean
CI green (Security Audit specifically)

Summary by Sourcery

Pin the transitive fflate dependency to a patched version to prevent denial-of-service attacks from malformed ZIP64 archives.

Bug Fixes:

Force fflate to version 0.8.3 or later to address the ZIP64 parsing infinite-loop denial-of-service vulnerability.

Enhancements:

Document the fflate security override and its transitive relationship to jspdf.

Documentation:

Update the dependency audit records with the fflate advisory, affected versions, and patched version.

Chores:

Refresh the pnpm lockfile to resolve fflate at the patched version.

…-px8p-9vwx-vf98) fflate through 0.8.2 hangs in an infinite loop inside unzipSync() when parsing a crafted ZIP archive whose central directory declares the ZIP64 compressed_size sentinel (0xFFFFFFFF) but omits the required ZIP64 extra field -- z64e() reads out of bounds, the result coerces to 0, and the loop condition never becomes false. CVSS 7.5, CVE-2026-45820. Transitive via jspdf (already pinned to the latest 4.2.1, which already declares "fflate": "^0.8.1" -- a range 0.8.3 already satisfies, so no jspdf bump was needed, just forcing pnpm's resolution to the patched version already within range). The advisory was only elevated to GitHub-reviewed status today (2026-09-03T14:58:12Z, confirmed via the GitHub Advisories API) -- it is not something any recent change in this repo introduced; main's own Security Audit job passed clean two hours before this run first caught it.

codeant-ai · 2026-09-03T15:31:21Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	`d1ba462`	Sep 03, 2026 · 15:31	15:33

codeant-ai · 2026-09-03T15:31:21Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

sourcery-ai

Sorry @qnbs, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 14 hours and 18 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

vercel · 2026-09-03T15:31:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
worldscript-studio	Ready	Preview	Sep 3, 2026 4:17pm UTC

coderabbitai · 2026-09-03T15:31:25Z

Warning

Review limit reached

Next included review available in 1 minute.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 72 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: 21781822-24d9-4c7d-8888-b623b2b389b4

📥 Commits

Reviewing files that changed from the base of the PR and between 041f20e and e5a4d07.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

AUDIT.md
pnpm-workspace.yaml

_{Comment @coderabbitai help to get the list of available commands.}

sourcery-ai · 2026-09-03T15:31:34Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This security fix overrides pnpm's transitive fflate resolution to require >=0.8.3, ensuring jspdf uses the patched ZIP64 parser and preventing the unzipSync() infinite-loop DoS; the lockfile and workspace security documentation are updated accordingly.

File-Level Changes

Change	Details	Files
Force the patched fflate release across the workspace while documenting the security exception and dependency rationale.	Add a pnpm override requiring fflate 0.8.3 or newer. Document the GHSA/CVE, vulnerable behavior, fixed version, and jspdf transitive dependency path. Update the lockfile to resolve fflate to the patched version.	`pnpm-workspace.yaml` `pnpm-lock.yaml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

what-the-diff · 2026-09-03T15:31:42Z

PR Summary

Upgraded the "fflate" software library version
The team has updated the version of the software library "fflate" we use in our project. This specifically updated our package's version from version "0.8.2" to "0.8.3".
Forcing the use of the updated "fflate" version
We have also ensured that only this updated version "0.8.3" of "fflate" will be used within our project by adding a requirement in our configuration files.
Added security notes relating to "fflate"
To make everyone aware of the potential risks, we included a specific security note regarding this library. It gives details about a resolved security issue (tagged CVE-2026-45820) dealing with how certain complex files, ZIP64 archives, are handled. The note states that this problem has been addressed in the updated version that we are now using.

deepsource-io · 2026-09-03T15:31:56Z

DeepSource Code Review

We reviewed changes in 041f20e...e5a4d07 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Docker	Sep 3, 2026 4:17p.m.	Review ↗
Python	Sep 3, 2026 4:17p.m.	Review ↗
Rust	Sep 3, 2026 4:17p.m.	Review ↗
Shell	Sep 3, 2026 4:17p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

amazon-q-developer

This PR successfully migrates the project to a pnpm workspace structure. The changes to the lock file and workspace configuration are consistent with this migration, with no blocking issues identified.

The pnpm-lock.yaml has been properly regenerated with lockfileVersion 9.1, and all dependencies maintain their integrity hashes. The workspace configuration in pnpm-workspace.yaml correctly defines the package structure.

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

codeant-ai · 2026-09-03T15:32:56Z

🏁 CodeAnt Quality Gate Results

Commit:e5a4d071
Scan Time: 2026-09-03 16:18:10 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found, 1 false positive secret suppressed
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

cubic-dev-ai

All reported issues were addressed across 2 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

codecov · 2026-09-03T15:48:00Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

cubic-dev-ai

2 issues found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="AUDIT.md">
<violation number="1" location="AUDIT.md:1855">
P3: Because the override accepts every version at or above `0.8.3`, saying “fixed 0.8.3” leaves the safe range ambiguous. Change this to “fixed at or above 0.8.3” to match the documented floor.</violation>
<violation number="2" location="AUDIT.md:1855">
P3: The table preamble now omits `fflate` from its re-verification-date exceptions even though this row records a 2026-09-03 advisory update. Add `fflate` and its 2026-09-03 verification date to that exception list, or update the table’s verification metadata so the audit record remains accurate.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…e the fixed-version wording

codescene-access

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile:The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

* chore(release): bump version to v1.28.4 Patch release reconciling release-truth documentation with everything merged to main since v1.28.3 (62 commits / ~40 PRs, audited against live GitHub state, not assumed from commit subjects): - fix: PWA first-install unprompted reload (#585, PR #613) - fix: shared-origin service-worker cache-read isolation (#514, PR #612) - fix: Factory Reset could reboot into Settings instead of Welcome Portal (PR #592) - fix: preserve-first desktop corruption recovery (PR #542) and a distinct filesystem-I/O recovery action (PR #545) - fix: intentionally cleared project metadata no longer reappears (PR #546) - a11y: Welcome/Home dashboard WCAG AA contrast + reduced-motion cascade fix + default appearance preset change (#565, PR #609); ManuscriptEditor contrast (PR #560) - security: fflate ZIP64-parsing DoS override (PR #595); routine dependency floor bumps (PR #587, #561, #562, #594) - docs: R-15 secure desktop storage design contract admitted (PRs #564, #580, #581, #582, #584) — design only, no implementation yet - tests: visual regression testing repaired — baselines were directory listings, not the application (PR #610); IDB reset-quiescence hardening (PR #596); WelcomePortal E2E navigation made locale-independent (PR #590) Everything classified as pure internal/CI-governance churn (PR-size exception plumbing, dual-graph tooling, toolchain pins) is omitted from CHANGELOG.md as non-user-facing. Version bumped via the existing sync scripts (sync-tauri-version.mjs, sync-sw-version.mjs) across package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, src-tauri/Cargo.lock, AGENTS.md, and public/sw.js's APP_VERSION. CHANGELOG.md and README.md use the established release-candidate marker convention () so the dated entry and version badge are truthful before the v1.28.4 tag exists; both markers are removed in a follow-up post-release truth-sync once the tag and GitHub Release are published, matching the v1.28.2/v1.28.3 precedent. TODO.md's Current Sprint section was archived (its final "release cut remains open" bullet is now resolved — v1.28.2 and v1.28.3 both shipped) and replaced with the actual current sprint: this release cut followed by the R-15 desktop at-rest encryption priority program. AUDIT.md is intentionally not touched here — its release-gate entry requires real post-merge CI/CodeQL run evidence that doesn't exist until after this PR merges and the tag is cut, matching how every prior release's AUDIT.md entry was written (a follow-up commit, not part of the release-prep PR itself). * docs(release): correct premature done-marker on the v1.28.4 TODO item TODO.md's Current Sprint marked the release cut as done (checked 'v1.28.4' release cut, reconciling ... AUDIT.md truth ...) while this same PR's own Non-goals section correctly states AUDIT.md is not touched here, and while no tag, GitHub Release, or release artifacts exist yet. Corrected to in-progress language naming PR #615 directly and listing what actually remains pending (tag, release, artifacts, post-release AUDIT.md evidence). * docs(release): correct R-15 gate language and credit PR #596's real fix Two corrections from review, verified against live evidence before fixing: 1. TODO.md's Current Sprint claimed R-15 desktop at-rest encryption implementation was being prioritized now. docs/native/DESKTOP- MIGRATION-ROADMAP-REV3.md explicitly forbids pulling Wave 3/4 R-15 implementation ahead of unresolved Wave 2 authority prerequisites, and CORE-MIGRATION-LEDGER.md row 10 records S5_IMPLEMENTATION_READY=NO. Corrected to state R-15 design is complete but implementation stays gated behind the still-open Wave 2 prerequisite (ledger row 9: the project state-shape compatibility adapter), which is what this sprint's desktop-storage work actually is. 2. CHANGELOG.md listed PR #596 only as generic IDB test hardening under Tests. Verified against its actual diff: deleteDatabase() previously resolved on a genuine onerror or an onblocked event as if deletion succeeded, so wipeAllAppData() could report Factory Reset complete while a database was never actually deleted. onerror now rejects; onblocked waits for the connection to close before giving up. This is a real production data-integrity fix, not test hardening, and now has its own Fixed entry.

sourcery-aiBot reviewed Sep 3, 2026
View reviewed changes

codeant-aiBot added the size:XS This PR changes 0-9 lines, ignoring generated files label Sep 3, 2026

This comment was marked as outdated.
Sign in to view

amazon-q-developerBot reviewed Sep 3, 2026
View reviewed changes

cubic-dev-aiBot reviewed Sep 3, 2026
View reviewed changes

Comment threadpnpm-workspace.yaml
Comment threadpnpm-workspace.yaml

docs(audit): add fflate to the Known Overrides Table
c100384

This comment was marked as outdated.
Sign in to view

cubic-dev-aiBot reviewed Sep 3, 2026
View reviewed changes

Comment threadAUDIT.md Outdated
Comment threadAUDIT.md Outdated

docs(audit): add fflate to the re-verification exception list, precis…
e5a4d07
…e the fixed-version wording

codescene-accessBot approved these changes Sep 3, 2026
View reviewed changes

qnbs merged commit 49159dc into mainSep 3, 2026
41 checks passed

qnbs deleted the fix/fflate-ghsa-px8p-zip64-dos branch September 3, 2026 16:45

This was referenced Sep 3, 2026
fix(e2e): eliminate WelcomePortal startup/navigation nondeterminism (#532) #583
Closed
chore(release): bump version to v1.28.4 #615
Merged

Conversation

qnbs commented Sep 3, 2026• edited by sourcery-ai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by Sourcery

Uh oh!

codeant-aiBot commented Sep 3, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-aiBot commented Sep 3, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

sourcery-aiBot left a comment

Choose a reason for hiding this comment

Uh oh!

vercelBot commented Sep 3, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitaiBot commented Sep 3, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

sourcery-aiBot commented Sep 3, 2026

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

what-the-diffBot commented Sep 3, 2026

PR Summary

Uh oh!

This comment was marked as outdated.

Uh oh!

deepsource-ioBot commented Sep 3, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

amazon-q-developerBot left a comment

Choose a reason for hiding this comment

Uh oh!

codeant-aiBot commented Sep 3, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 CodeAnt Quality Gate Results

✅ Overall Status: PASSED

Quality Gate Details

Uh oh!

cubic-dev-aiBot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecovBot commented Sep 3, 2026

Codecov Report

Uh oh!

This comment was marked as outdated.

Uh oh!

cubic-dev-aiBot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codescene-accessBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qnbs commented Sep 3, 2026•
edited by sourcery-ai Bot
Loading

codeant-aiBot commented Sep 3, 2026•
edited
Loading

vercelBot commented Sep 3, 2026•
edited
Loading

coderabbitaiBot commented Sep 3, 2026•
edited
Loading

deepsource-ioBot commented Sep 3, 2026•
edited
Loading

codeant-aiBot commented Sep 3, 2026•
edited
Loading

cubic-dev-aiBot left a comment •
edited
Loading

cubic-dev-aiBot left a comment •
edited
Loading