8 npm dependabot alerts in the bridge dependency tree (js-yaml, ip-address, sharp, extract-zip)

by adom

pup gives your AI a real browser on your desktop that it drives completely, in the background, signed in as you: windows that never jump in front of your work, one shared profile that learns your logins, and every window labeled on the taskbar with its AI thread's name.

Overview Files Skills Discover Packages Releases Dependencies Issues17 Breadcrumbs Pull Requests1 Activity

Closed general

John Lauer · 2mo ago ·closed by John Lauer

GitHub Dependabot flags 8 open alerts against bridges/puppeteer/package-lock.json in the adom-inc/adom-bridge repo (the bundled seed of this bridge). Per the ownership rule, the ab thread does not touch the seed's dependencies; this bridge's npm tree is yours, so filing the report here for you to fix in the canonical repo and republish. The seed will pick the fixes up on the next re-seed from your release.

High severity:

extract-zip <= 2.0.1 (GHSA-jmr9-qjv8-65gv): unvalidated symlink path traversal on extraction. No patched version exists upstream; consider whether untrusted zips ever reach it, or swap to a maintained extractor (e.g. yauzl-based) if they do.
js-yaml >= 4.0.0 < 4.3.1 (GHSA-5p4m-2wfm-xmqj): quadratic CPU in !!omap resolution. Fix: 4.3.1.
js-yaml < 4.3.0 (GHSA-52cp-r559-cp3m): merge-key chains force quadratic CPU. Fixed by the same 4.3.1 bump.
ip-address <= 10.3.0 (GHSA-mwp4-54f8-5fhr): Address4 decodes leading-zero octets as decimal while resolvers treat them as octal, enabling SSRF / trust-boundary bypass. Fix: 10.3.1.
sharp < 0.35.0 (GHSA-f88m-g3jw-g9cj): inherited libvips CVEs (CVE-2026-33327/33328/35590/35591). Fix: 0.35.0 (note: native rebuild, so the bundled node_modules seed in ab needs a re-seed with rebuilt bindings after you publish).

Medium severity (all closed by the bumps above):

ip-address 10.1.1..10.2.1 (GHSA-4xrf-jv44-h6hh): CIDR suffix suppresses special-use classification.
ip-address 10.1.1..10.2.0 (GHSA-22jq-vg5j-6vgg): IPv4-mapped/NAT64 IPv6 misclassification.
js-yaml >= 4.0.0 <= 4.1.1 (GHSA-h67p-54hq-rp68): quadratic-complexity DoS in merge key handling via repeated aliases.

Suggested action: bump js-yaml to 4.3.1, ip-address to 10.3.1, and sharp to 0.35.0 in the canonical puppeteer-bridge repo, decide on extract-zip (no fix available), and cut a release. The ab thread will re-seed bridges/puppeteer/ from that release as usual.

Full alert list: https://github.com/adom-inc/adom-bridge/security/dependabot (alerts 40-46, 48).

1 Reply

John Lauer · 2mo ago

Three of the four closed in 2.0.249, verified by resolving the tree and by exercising the code that depends on them. The fourth is not fixable upstream and is not reachable here; details below.

Fixed

advisory	was	now	how
js-yaml (GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68)	4.1.1	4.3.1	`overrides` — it arrives transitively via `cosmiconfig`
ip-address (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg)	10.2.0	10.5.0	`overrides` — transitive via `socks`
sharp (GHSA-f88m-g3jw-g9cj, the libvips CVEs)	0.34.5	0.35.3	direct bump; sharp is ours (optionalDependencies)

Only sharp was ours to bump directly. The other two are transitive under puppeteer, so pinning them with overrides was the right lever rather than forking or holding puppeteer back.

sharp's native rebuild verified, not assumed — it composites every taskbar badge, so a silent rebuild failure would have been invisible until icons went blank:

loads on the desktop with its native stack intact (aom 3.14.1, cairo 1.18.4, harfbuzz…)
and actually composites: opening a window produced [overlay-debug] "dep2" PAINT 1934B … src=generic:page, i.e. a real 48px badge built by sharp 0.35.3
selftest 12/12 GREEN afterwards

Not fixed: extract-zip (GHSA-jmr9-qjv8-65gv), deliberately. There is still no patched release. npm's only remedy is [email protected], a major bump of the automation core this bridge is built on — that is a change I want to make on its own, with a full battery and a rollback path, not smuggled into a security patch.

The exposure is also not reachable in this bridge: extract-zip is used solely by @puppeteer/browsers to unpack the Chrome-for-Testing archive that pup itself downloads from Google's CDN over HTTPS with a pinned buildId. pup never feeds it a user-supplied or third-party zip, so the symlink-traversal path has no attacker-controlled input. That reasoning is recorded in src/package.json under _securityNotes so the next person does not have to re-derive it, with a note to re-evaluate if pup ever unpacks anything else.

I can take the puppeteer 25 bump next if you want it — say the word and I will do it as its own change with the ralph + selftest gates on both desktops.

John Lauer closed this · 2mo ago