lob / lob-node / 33661403258

96%

master: 100%

push

github

SYN-646: Clear high-severity vuln findings via dependency upgrades (#313)

* SYN-646: clear high-severity vuln findings via lockfile bumps

Resolves all 5 high, 3 moderate, and 1 low npm audit findings (9 total,
0 remaining). Most fixes are lockfile-only version bumps within already-
declared caret ranges (axios, form-data, js-yaml, brace-expansion,
browserslist, json-2-csv, @babel/core) — no package.json range changes
needed, and each bump goes as high as the safe patched version allows.

The one exception is uuid (transitive via nyc's istanbul-lib-processinfo,
which pins ^8.3.2): fixing it requires a semver-major override to
^11.1.1. Verified via full test suite + coverage report that nyc's
coverage output is unaffected before keeping this override.

lob-node-admin has the same findings and needs an identical set of
bumps in a follow-up PR on that repo.

* SYN-646: bump form-data's declared range to ^4.0.6

The lockfile-only bump already resolved form-data to 4.0.6 for this
repo's own installs, but package.json's dependency range was still
^4.0.5. Since the published lob package ships no lockfile, a fresh
`npm install lob` would resolve form-data against that declared range
and could still land on the vulnerable 4.0.5 (GHSA-hmw2-7cc7-3qxx,
CRLF injection). axios's ^1.16.1 range already covers its fix; this
closes the same gap for form-data so the fix reaches consumers of the
published package, not just this repo's CI.

Caught by adversarial review before merge.

* chore: sync package-lock.json root manifest with form-data range bump

* SYN-646: fix uuid moderate finding correctly, drop the override

The previous approach forced uuid to ^11.1.1 via an override on
istanbul-lib-processinfo, a semver-major jump outside nyc's own
declared range (^8.3.2). On closer look that override was fixing a
non-issue: the flagged CVE (GHSA-w5hq-g745-h8pq) only affects uuid's
v3/v5/v6 functions when a caller passes a custom `buf` argument, and
istanbul-lib-processinf... (continued)

165 of 174 branches covered (94.83%)

292 of 304 relevant lines covered (96.05%)

31.8 hits per line