Resolve 4 critical dependency vulnerabilities (protobufjs, vitest, shell-quote) reported by pnpm audit
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 37.4k
- Forks
- 3k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 73
Description
pnpm audit currently reports 4 critical advisories (3 distinct packages). These are pre-existing in the dependency tree.
| Package | Advisory | Vulnerable | Patched | Path |
|---|---|---|---|---|
| shell-quote | GHSA-w7jw-789q-3m8p — quote() doesn't escape newlines in object .op values |
<=1.8.3 |
>=1.8.4 |
direct dep of apps/dokploy |
| vitest | GHSA-5xrq-8626-4rwp — arbitrary file read+exec while the Vitest UI server is listening | >=4.0.0 <4.1.0 |
>=4.1.0 |
apps/dokploy > vitest; packages/server > @better-auth/cli > better-auth > vitest |
| protobufjs | GHSA-xq3m-2v4x-88gg — arbitrary code execution | <7.5.5 |
>=7.5.5 |
transitive: apps/api > inngest > @opentelemetry/... > @grpc/proto-loader > protobufjs |
(The audit counts vitest twice for its two paths → 4.)
Notable: shell-quote is the highest real-world concern — it's a direct dependency of apps/dokploy and shell-quoting is on the command-construction path of a deploy platform. protobufjs is purely transitive (7 levels deep under OpenTelemetry/gRPC), so it can only be fixed via a version pin. vitest is dev/test-only.
Proposed fix
Scoped pnpm.overrides in the root package.json that pin only the vulnerable ranges to their patched minimums — surgical, leaves all other versions untouched, and covers the transitive paths. Verified: pnpm install succeeds and pnpm audit reports 0 criticals afterward (237 → 222 total vulns).
PR incoming.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the root package.json and inspect the proposed pnpm.overrides for shell-quote, vitest, and protobufjs. Run pnpm install and pnpm audit to verify the dependency resolution; done means the install succeeds and pnpm audit reports zero critical vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100