From a9789344dcd6e8337669066b62f8082ab9cc7224 Mon Sep 17 00:00:00 2001 From: Ilya Krasnov Date: Sun, 4 Oct 2026 11:07:07 +0300 Subject: [PATCH 1/2] fix: dependency security vulnerabilities (DELO-6676) Bump transitive @grpc/grpc-js 1.14.4 -> 1.14.5 (Improper Certificate Validation, GHSA-m9gg-hp2v-232j) via lockfile refresh. Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- yarn.lock | 40 ++++++++++++++++++++-------------------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/package.json b/package.json index da97698..f362710 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "web-speed-test-server", - "version": "1.3.15", + "version": "1.3.16", "private": true, "scripts": { "test": "mocha", diff --git a/yarn.lock b/yarn.lock index 396d80e..19c2350 100644 --- a/yarn.lock +++ b/yarn.lock @@ -22,9 +22,9 @@ kuler "^2.0.0" "@grpc/grpc-js@^1.14.3": - version "1.14.4" - resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.14.4.tgz#e73ff57d97802f063999545f43ebb2b1eca65d9d" - integrity sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ== + version "1.14.5" + resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.14.5.tgz#12f97bd9f716358e377ffaa768195d1219eb76a3" + integrity sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw== dependencies: "@grpc/proto-loader" "^0.8.0" "@js-sdsl/ordered-map" "^4.4.2" @@ -519,11 +519,11 @@ integrity sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q== "@types/node@*", "@types/node@>=13.7.0": - version "22.20.3" - resolved "https://registry.yarnpkg.com/@types/node/-/node-22.20.3.tgz#f77d48b4cb336b4e6dc44850ddb6da69caade396" - integrity sha512-DZmzkmwHzXrLPAXPyKNDzlIwMMUZCVacoD25ywdy5YTKGbOx/2ld+Q38Im2zJ0vBuZP5Prd3VZutKZyXwkOS8A== + version "26.6.4" + resolved "https://registry.yarnpkg.com/@types/node/-/node-26.6.4.tgz#5aaac1a7337945f7f9a2de4e0d14e7107157e813" + integrity sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg== dependencies: - undici-types "~6.21.0" + undici-types "~8.9.0" "@types/superagent@4.1.13": version "4.1.13" @@ -557,9 +557,9 @@ ansi-regex@^5.0.1: integrity sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ== ansi-regex@^6.2.2: - version "6.3.0" - resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.3.0.tgz#247c8e7b70a1a43b10ce14c0226fcbf58e8815d5" - integrity sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ== + version "6.4.0" + resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.4.0.tgz#69093d6436d30dbb9b04fe7bdcbcfe16c697d8a1" + integrity sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw== ansi-styles@^4.0.0, ansi-styles@^4.1.0: version "4.3.0" @@ -1350,9 +1350,9 @@ he@^1.2.0: integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw== http-cache-semantics@^4.2.0: - version "4.2.0" - resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz#205f4db64f8562b76a4ff9235aa5279839a09dd5" - integrity sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ== + version "4.3.0" + resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz#09eead3b16c6d85552857cc3fbd888d8353a2aaf" + integrity sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA== http-errors@~2.0.0, http-errors@~2.0.1: version "2.0.1" @@ -1386,9 +1386,9 @@ iconv-lite@~0.4.24: safer-buffer ">= 2.1.2 < 3" import-in-the-middle@^3.0.0: - version "3.5.1" - resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.5.1.tgz#74fc490851751005dc2f776a87bc8a075904b474" - integrity sha512-mPKuL8bPQzecui2KK6Gb+M8JvJoHnhS1FeYGa22QopBmlevF5F0FE6ued/B5EgHDeIoMTONIpDWWFKUPOG0DBQ== + version "3.5.2" + resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.5.2.tgz#c017ecf4fe1f83da743793ea9321519131cd3135" + integrity sha512-WseIA/4o56+GYO3RmlOPvejYi771OFeJEeK/ejROsr9bdjW+E5NXTOD1Di8TL40Qgg3JJX9aa97Hf8iiSVIKZw== dependencies: cjs-module-lexer "^2.2.0" es-module-lexer "^3.0.2" @@ -2340,10 +2340,10 @@ type-is@~1.6.18: media-typer "0.3.0" mime-types "~2.1.24" -undici-types@~6.21.0: - version "6.21.0" - resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.21.0.tgz#691d00af3909be93a7faa13be61b3a5b50ef12cb" - integrity sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ== +undici-types@~8.9.0: + version "8.9.0" + resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-8.9.0.tgz#e240d97c8b5d85e5347ce73d25865c7906c1ec9f" + integrity sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg== universalify@^2.0.0: version "2.0.1" From 6b34357753fd045c47ad34a2eab9ae46ff3bc4e7 Mon Sep 17 00:00:00 2001 From: Ilya Krasnov Date: Wed, 7 Oct 2026 09:12:05 +0300 Subject: [PATCH 2/2] fix: pin @grpc/grpc-js via resolutions, drop manual version bump - Add `@grpc/grpc-js: ^1.14.5` to resolutions so the parent range (^1.14.3) can't re-admit the vulnerable 1.14.3/1.14.4 (GHSA-m9gg-hp2v-232j). - Revert package.json version to 1.3.15; release-please owns it. - Rebuild yarn.lock from master so only the grpc-js entry changes, keeping @types/node at 22.20.3 and dropping unrelated transitive bumps. Co-Authored-By: Claude Opus 5.5 --- package.json | 5 +++-- yarn.lock | 36 ++++++++++++++++++------------------ 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/package.json b/package.json index f362710..e328769 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "web-speed-test-server", - "version": "1.3.16", + "version": "1.3.15", "private": true, "scripts": { "test": "mocha", @@ -46,6 +46,7 @@ "resolutions": { "protobufjs": "^7.6.5", "qs": "^6.16.0", - "proxy-addr": "^2.0.8" + "proxy-addr": "^2.0.8", + "@grpc/grpc-js": "^1.14.5" } } diff --git a/yarn.lock b/yarn.lock index 19c2350..cee571d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -21,7 +21,7 @@ enabled "2.0.x" kuler "^2.0.0" -"@grpc/grpc-js@^1.14.3": +"@grpc/grpc-js@^1.14.3", "@grpc/grpc-js@^1.14.5": version "1.14.5" resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.14.5.tgz#12f97bd9f716358e377ffaa768195d1219eb76a3" integrity sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw== @@ -519,11 +519,11 @@ integrity sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q== "@types/node@*", "@types/node@>=13.7.0": - version "26.6.4" - resolved "https://registry.yarnpkg.com/@types/node/-/node-26.6.4.tgz#5aaac1a7337945f7f9a2de4e0d14e7107157e813" - integrity sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg== + version "22.20.3" + resolved "https://registry.yarnpkg.com/@types/node/-/node-22.20.3.tgz#f77d48b4cb336b4e6dc44850ddb6da69caade396" + integrity sha512-DZmzkmwHzXrLPAXPyKNDzlIwMMUZCVacoD25ywdy5YTKGbOx/2ld+Q38Im2zJ0vBuZP5Prd3VZutKZyXwkOS8A== dependencies: - undici-types "~8.9.0" + undici-types "~6.21.0" "@types/superagent@4.1.13": version "4.1.13" @@ -557,9 +557,9 @@ ansi-regex@^5.0.1: integrity sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ== ansi-regex@^6.2.2: - version "6.4.0" - resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.4.0.tgz#69093d6436d30dbb9b04fe7bdcbcfe16c697d8a1" - integrity sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw== + version "6.3.0" + resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.3.0.tgz#247c8e7b70a1a43b10ce14c0226fcbf58e8815d5" + integrity sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ== ansi-styles@^4.0.0, ansi-styles@^4.1.0: version "4.3.0" @@ -1350,9 +1350,9 @@ he@^1.2.0: integrity sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw== http-cache-semantics@^4.2.0: - version "4.3.0" - resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz#09eead3b16c6d85552857cc3fbd888d8353a2aaf" - integrity sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA== + version "4.2.0" + resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz#205f4db64f8562b76a4ff9235aa5279839a09dd5" + integrity sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ== http-errors@~2.0.0, http-errors@~2.0.1: version "2.0.1" @@ -1386,9 +1386,9 @@ iconv-lite@~0.4.24: safer-buffer ">= 2.1.2 < 3" import-in-the-middle@^3.0.0: - version "3.5.2" - resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.5.2.tgz#c017ecf4fe1f83da743793ea9321519131cd3135" - integrity sha512-WseIA/4o56+GYO3RmlOPvejYi771OFeJEeK/ejROsr9bdjW+E5NXTOD1Di8TL40Qgg3JJX9aa97Hf8iiSVIKZw== + version "3.5.1" + resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-3.5.1.tgz#74fc490851751005dc2f776a87bc8a075904b474" + integrity sha512-mPKuL8bPQzecui2KK6Gb+M8JvJoHnhS1FeYGa22QopBmlevF5F0FE6ued/B5EgHDeIoMTONIpDWWFKUPOG0DBQ== dependencies: cjs-module-lexer "^2.2.0" es-module-lexer "^3.0.2" @@ -2340,10 +2340,10 @@ type-is@~1.6.18: media-typer "0.3.0" mime-types "~2.1.24" -undici-types@~8.9.0: - version "8.9.0" - resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-8.9.0.tgz#e240d97c8b5d85e5347ce73d25865c7906c1ec9f" - integrity sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg== +undici-types@~6.21.0: + version "6.21.0" + resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.21.0.tgz#691d00af3909be93a7faa13be61b3a5b50ef12cb" + integrity sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ== universalify@^2.0.0: version "2.0.1"