chore(deps): update lockfile and constrain simple-git version#265
chore(deps): update lockfile and constrain simple-git version#265zalewskigrzegorz merged 1 commit intomainfrom
Conversation
package.json
Outdated
| "react-dom": "19.2.4", | ||
| "axios": "1.12.2" | ||
| "axios": "1.12.2", | ||
| "simple-git": ">=3.32.3" |
There was a problem hiding this comment.
@zalewskigrzegorz can it be fixed with bumping @redocly/realm ?
Without adding overrides.
There was a problem hiding this comment.
Yeh, should be possible
https://github.com/Redocly/redocly/pull/21556
But IDK if this is already deployed I will check this locally
There was a problem hiding this comment.
Current version still had
'simple-git': '3.20.0',
Fix is in 3.32.3 We will need to wait for next release
There was a problem hiding this comment.
Overrides like this one is not practical.
Imagine
- someone review package.json file in a month
- then check the usage
- find that this package not used
- and we are back where started
IMHO its better to fix this in the @redocly/realm package.
There was a problem hiding this comment.
Yes, I agree. I'll update this PR as soon as the new package is released.
There was a problem hiding this comment.
Hey @DmitryAnansky – PR updated! We now have a new version that doesn't have this vulnerability.
zalewskigrzegorz
force-pushed
the
fix/simple-git-vulnerability
branch
from
43661c3 to
0685d53
Compare
zalewskigrzegorz
force-pushed
the
fix/simple-git-vulnerability
branch
from
0685d53 to
05d770d
Compare
| @@ -270,6 +360,7 @@ | |||
| "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz", | |||
| "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==", | |||
| "license": "MIT", | |||
| "peer": true, | |||
There was a problem hiding this comment.
@zalewskigrzegorz
What version of npm are you using?
2 participants
What/Why/How?
What: Fix CVE-2026-28292 in
simple-git(RCE via case-insensitiveprotocol.allowbypass).Why:
simple-git3.20.0 (transitive via@redocly/realm) had a critical vulnerability (CVSS 9.8) whereblockUnsafeOperationsPlugincould be bypassed with case variants likePROTOCOL.ALLOW=always, allowing arbitrary command execution via theext::protocol.How: Added an npm override to force
simple-gitto>=3.32.3, which includes the fix. Afternpm install, the resolved version is 3.33.0.Reference
Testing
npm installand confirmedsimple-gitresolves to 3.33.0 inpackage-lock.jsonnpm auditand confirmed the simple-git vulnerability is no longer reportedScreenshots (optional)
N/A
Check yourself
Security