Force Cashtab's plist transitive @xmldom/xmldom from 0.9.10 to >=0.9.12 to clear GHSA-6gmq-8vp8-gcm6 (EntityReference.nodeName XML fragment injection).
Details
- Reviewers
Fabien - Group Reviewers
Restricted Project - Commits
- rABCf741d5364ba8: [Cashtab] Override @xmldom/xmldom >=0.9.12 for XML injection fix
- pnpm install --lockfile-only
- rg '@xmldom/xmldom@' pnpm-lock.yaml # 0.9.12
- pnpm audit # xmldom GHSA gone; moderate 9→8
Diff Detail
- Repository
- rABC Bitcoin ABC
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) The three laws of code review: 1. Find bugs. 2. Find more bugs. 3. Find even more bugs.
────────────────────────────────────────────────────────────────────────
major [Security & Privacy] → ]8;;vscode://file//work/pnpm-workspace.yaml:29pnpm-workspace.yaml:29]8;; Bound the replacement range. pnpm uses the override value as the replacement dependency range. The range >=0.9.12 includes 1.0.0 and later versions. Use `>=0.9.12 <0.10.0` to keep the override within the 0.9.x series.
────────────────────────────────────────
Review complete
1 finding ✔
Major 1
2 files reviewed:
- pnpm-lock.yaml
- pnpm-workspace.yaml
────────────────────────────────────────
Print all AI prompts: coderabbit review --show-prompts
Rebase on latest master. Cap the @xmldom/xmldom override at >=0.9.12 <0.10.0 so pnpm cannot replace with 1.x (CodeRabbit).
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) Buckle up! It's going to be a buggy ride.
────────────────────────────────────────
Review complete
No findings ✔
2 files reviewed:
- pnpm-lock.yaml
- pnpm-workspace.yaml
────────────────────────────────────────