Skip to content

fix: override protobufjs to patch CVE GHSA-jvwf-75h9-cwgg - #121

Merged
MathurAditya724 merged 2 commits into
mainfrom
fix-protobufjs-cve
May 13, 2026
Merged

fix: override protobufjs to patch CVE GHSA-jvwf-75h9-cwgg#121
MathurAditya724 merged 2 commits into
mainfrom
fix-protobufjs-cve

Conversation

@MathurAditya724

@MathurAditya724MathurAditya724 commented May 13, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds a pnpm.overrides entry to force protobufjs to >=7.5.6, resolving GHSA-jvwf-75h9-cwgg (high severity — process-wide DoS through unsafe option paths)
  • The vulnerable protobufjs@7.4.0 was a transitive dependency via @atproto/bsky → etcd3 → @grpc/proto-loader; resolved to 8.2.0

Closes https://github.com/tsky-dev/tsky/security/dependabot/135

@MathurAditya724
fix: override protobufjs to >=7.5.6 to resolve CVE (GHSA-jvwf-75h9-cwgg)
354ca18
protobufjs <7.5.6 is vulnerable to process-wide denial of service
through unsafe option paths. The vulnerable version (7.4.0) was pulled
in transitively via @atproto/bsky -> etcd3 -> @grpc/proto-loader.
Added a pnpm override to force protobufjs >=7.5.6 (resolved to 8.2.0).
@netlify

netlifyBot commented May 13, 2026•
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for tsky ready!

NameLink
🔨 Latest commit3ffaffd
🔍 Latest deploy loghttps://app.netlify.com/projects/tsky/deploys/6a042ede0a5b9c0008e42cae
😎 Deploy Previewhttps://deploy-preview-121--tsky.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changesRun an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions

github-actionsBot commented May 13, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Coverage Report for ./packages/client/

StatusCategoryPercentageCovered / Total
🔵Lines13.64%52 / 381
🔵Statements13.13%52 / 396
🔵Functions9.6%17 / 177
🔵Branches14.45%12 / 83
File CoverageNo changed files found.
Generated in workflow #293 for commit 3ffaffd by the Vitest Coverage Report Action

@pkg-pr-new

pkg-pr-newBot commented May 13, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

pnpm add https://pkg.pr.new/@tsky/client@121

commit: 3ffaffd

@MathurAditya724

MathurAditya724 commented May 13, 2026

Copy link
Copy Markdown
ContributorAuthor

fix-ci: attempt 1 — the biome format check fails on generated files under packages/lexicons/lexicons/lexicon-resolver/. These are generated during pnpm install (via the prepare script) and gitignored, but biome still picks them up. This is a pre-existing issue on main (no code-gen files differ between branches). Adding the path to biome's ignore list.

@MathurAditya724

MathurAditya724 commented May 13, 2026•
edited
Loading

Copy link
Copy Markdown
ContributorAuthor

fix-ci: attempt 1 — the failing run was on 354ca18 (before the biome ignore fix). commit 3ffaffd already added packages/lexicons/lexicons/ to biome's ignore list, and CI is now green on the latest push. no further action needed.

@MathurAditya724
MathurAditya724 merged commit b896fbc into mainMay 13, 2026
9 checks passed
@MathurAditya724
MathurAditya724 deleted the fix-protobufjs-cve branch May 13, 2026 08:05
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MathurAditya724