From a9f8dcbd6869c864a6d5e92431c030d19421e114 Mon Sep 17 00:00:00 2001 From: uberbinge <1692495+uberbinge@users.noreply.github.com> Date: Thu, 5 Feb 2026 22:49:06 +0100 Subject: [PATCH] fix: resolve lodash-es prototype pollution vulnerability (GHSA-xxjr-mmjv-4gpg) --- .projenrc.js | 7 ++++ package.json | 3 +- yarn.lock | 97 +++++++++++++++++++++++++--------------------------- 3 files changed, 54 insertions(+), 53 deletions(-) diff --git a/.projenrc.js b/.projenrc.js index 60885bc..cfc608c 100644 --- a/.projenrc.js +++ b/.projenrc.js @@ -45,6 +45,13 @@ project.addDevDeps('jest@^29'); project.addDevDeps('ts-jest@^29'); project.addBundledDeps('js-toml@^1.0.2'); +// Fix for GHSA-xxjr-mmjv-4gpg: lodash-es prototype pollution vulnerability +// js-toml -> chevrotain -> lodash-es@4.17.21 is vulnerable +// Force chevrotain@11.1.1+ which uses lodash-es@4.17.23 (patched) +project.package.addField('resolutions', { + 'chevrotain': '^11.1.1', +}); + project.addGitIgnore('target'); project.gitignore.removePatterns('*.tgz'); diff --git a/package.json b/package.json index ec4c499..e620255 100644 --- a/package.json +++ b/package.json @@ -71,8 +71,7 @@ "js-toml" ], "resolutions": { - "@types/babel__traverse": "7.18.2", - "@types/prettier": "2.6.0" + "chevrotain": "^11.1.1" }, "keywords": [ "cdk" diff --git a/yarn.lock b/yarn.lock index f9ff756..cbadd7c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -311,37 +311,37 @@ resolved "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz" integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw== -"@chevrotain/cst-dts-gen@11.0.3": - version "11.0.3" - resolved "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.0.3.tgz" - integrity sha512-BvIKpRLeS/8UbfxXxgC33xOumsacaeCKAjAeLyOn7Pcp95HiRbrpl14S+9vaZLolnbssPIUuiUd8IvgkRyt6NQ== - dependencies: - "@chevrotain/gast" "11.0.3" - "@chevrotain/types" "11.0.3" - lodash-es "4.17.21" - -"@chevrotain/gast@11.0.3": - version "11.0.3" - resolved "https://registry.npmjs.org/@chevrotain/gast/-/gast-11.0.3.tgz" - integrity sha512-+qNfcoNk70PyS/uxmj3li5NiECO+2YKZZQMbmjTqRI3Qchu8Hig/Q9vgkHpI3alNjr7M+a2St5pw5w5F6NL5/Q== - dependencies: - "@chevrotain/types" "11.0.3" - lodash-es "4.17.21" - -"@chevrotain/regexp-to-ast@11.0.3": - version "11.0.3" - resolved "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.0.3.tgz" - integrity sha512-1fMHaBZxLFvWI067AVbGJav1eRY7N8DDvYCTwGBiE/ytKBgP8azTdgyrKyWZ9Mfh09eHWb5PgTSO8wi7U824RA== - -"@chevrotain/types@11.0.3": - version "11.0.3" - resolved "https://registry.npmjs.org/@chevrotain/types/-/types-11.0.3.tgz" - integrity sha512-gsiM3G8b58kZC2HaWR50gu6Y1440cHiJ+i3JUvcp/35JchYejb2+5MVeJK0iKThYpAa/P2PYFV4hoi44HD+aHQ== - -"@chevrotain/utils@11.0.3": - version "11.0.3" - resolved "https://registry.npmjs.org/@chevrotain/utils/-/utils-11.0.3.tgz" - integrity sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ== +"@chevrotain/cst-dts-gen@11.1.1": + version "11.1.1" + resolved "https://registry.yarnpkg.com/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.1.1.tgz#4224e0bb05064f7186886b5d9371e6ea9ff29326" + integrity sha512-fRHyv6/f542qQqiRGalrfJl/evD39mAvbJLCekPazhiextEatq1Jx1K/i9gSd5NNO0ds03ek0Cbo/4uVKmOBcw== + dependencies: + "@chevrotain/gast" "11.1.1" + "@chevrotain/types" "11.1.1" + lodash-es "4.17.23" + +"@chevrotain/gast@11.1.1": + version "11.1.1" + resolved "https://registry.yarnpkg.com/@chevrotain/gast/-/gast-11.1.1.tgz#f2af299cafb9b578912880e28df20f84b8507cab" + integrity sha512-Ko/5vPEYy1vn5CbCjjvnSO4U7GgxyGm+dfUZZJIWTlQFkXkyym0jFYrWEU10hyCjrA7rQtiHtBr0EaZqvHFZvg== + dependencies: + "@chevrotain/types" "11.1.1" + lodash-es "4.17.23" + +"@chevrotain/regexp-to-ast@11.1.1": + version "11.1.1" + resolved "https://registry.yarnpkg.com/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.1.1.tgz#a413f59f82590df8d869d7c6233767aff734ba2e" + integrity sha512-ctRw1OKSXkOrR8VTvOxrQ5USEc4sNrfwXHa1NuTcR7wre4YbjPcKw+82C2uylg/TEwFRgwLmbhlln4qkmDyteg== + +"@chevrotain/types@11.1.1": + version "11.1.1" + resolved "https://registry.yarnpkg.com/@chevrotain/types/-/types-11.1.1.tgz#cfae33d6cfb3048a1ad8fc2277ee9fcf3e9252c9" + integrity sha512-wb2ToxG8LkgPYnKe9FH8oGn3TMCBdnwiuNC5l5y+CtlaVRbCytU0kbVsk6CGrqTL4ZN4ksJa0TXOYbxpbthtqw== + +"@chevrotain/utils@11.1.1": + version "11.1.1" + resolved "https://registry.yarnpkg.com/@chevrotain/utils/-/utils-11.1.1.tgz#ba7608d5d3e358127dc0a89e2be24d131d36f750" + integrity sha512-71eTYMzYXYSFPrbg/ZwftSaSDld7UYlS8OQa3lNnn9jzNtpFbaReRRyghzqS7rI3CDaorqpPJJcXGHK+FE1TVQ== "@csstools/color-helpers@^5.1.0": version "5.1.0" @@ -898,7 +898,7 @@ "@babel/parser" "^7.1.0" "@babel/types" "^7.0.0" -"@types/babel__traverse@*", "@types/babel__traverse@7.18.2", "@types/babel__traverse@^7.0.6": +"@types/babel__traverse@*", "@types/babel__traverse@^7.0.6": version "7.18.2" resolved "https://registry.yarnpkg.com/@types/babel__traverse/-/babel__traverse-7.18.2.tgz#235bf339d17185bdec25e024ca19cce257cc7309" integrity sha512-FcFaxOr2V5KZCviw1TnutEMVUVsGt4D2hP1TAfXZAMKuHYW3xQhe3jTxNPWutgCJ3/X1c5yX8ZoGVEItxKbwBg== @@ -971,11 +971,6 @@ resolved "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.4.tgz" integrity sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA== -"@types/prettier@2.6.0": - version "2.6.0" - resolved "https://registry.yarnpkg.com/@types/prettier/-/prettier-2.6.0.tgz#efcbd41937f9ae7434c714ab698604822d890759" - integrity sha512-G/AdOadiZhnJp0jXCaBQU449W2h716OW/EoXeYkCytxKL06X1WCXB4DZpp8TpZ8eyIJVS1cw4lrlkkSYU21cDw== - "@types/stack-utils@^2.0.0": version "2.0.3" resolved "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz" @@ -1624,17 +1619,17 @@ char-regex@^1.0.2: resolved "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz" integrity sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw== -chevrotain@^11.0.3: - version "11.0.3" - resolved "https://registry.npmjs.org/chevrotain/-/chevrotain-11.0.3.tgz" - integrity sha512-ci2iJH6LeIkvP9eJW6gpueU8cnZhv85ELY8w8WiFtNjMHA5ad6pQLaJo9mEly/9qUyCpvqX8/POVUTf18/HFdw== +chevrotain@^11.0.3, chevrotain@^11.1.1: + version "11.1.1" + resolved "https://registry.yarnpkg.com/chevrotain/-/chevrotain-11.1.1.tgz#39be6f767cb22cc6a728246995ba906c5c2f2157" + integrity sha512-f0yv5CPKaFxfsPTBzX7vGuim4oIC1/gcS7LUGdBSwl2dU6+FON6LVUksdOo1qJjoUvXNn45urgh8C+0a24pACQ== dependencies: - "@chevrotain/cst-dts-gen" "11.0.3" - "@chevrotain/gast" "11.0.3" - "@chevrotain/regexp-to-ast" "11.0.3" - "@chevrotain/types" "11.0.3" - "@chevrotain/utils" "11.0.3" - lodash-es "4.17.21" + "@chevrotain/cst-dts-gen" "11.1.1" + "@chevrotain/gast" "11.1.1" + "@chevrotain/regexp-to-ast" "11.1.1" + "@chevrotain/types" "11.1.1" + "@chevrotain/utils" "11.1.1" + lodash-es "4.17.23" ci-info@^3.2.0: version "3.9.0" @@ -4068,10 +4063,10 @@ locate-path@^6.0.0: dependencies: p-locate "^5.0.0" -lodash-es@4.17.21: - version "4.17.21" - resolved "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.21.tgz" - integrity sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw== +lodash-es@4.17.23: + version "4.17.23" + resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.23.tgz#58c4360fd1b5d33afc6c0bbd3d1149349b1138e0" + integrity sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg== lodash.ismatch@^4.4.0: version "4.4.0"