fix(deps): resolve postcss + tar audit findings via overrides#8612
Merged
Conversation
npm audit flagged postcss <=8.5.17 (path traversal in previous-sourcemap auto-loading, GHSA-r28c-9q8g-f849, high) and tar <=7.5.20 (uncontrolled recursion DoS via crafted long-path tar, GHSA-r292-9mhp-454m, moderate), both transitive. Pin both via overrides, matching this file's existing pattern for other transitive-dep security fixes: bump the existing tar override past its first-patched version (7.5.19 -> 7.5.21) and add a new postcss override (8.5.18, first patched version). Closes task 1 of #8588's checklist. The remaining findings in that issue (eslint v10 bump for the brace-expansion/minimatch chain, the @esbuild-kit->tsx trace, and the recharts v3 migration) are unrelated, each need their own scoping, and are now tracked as sub-issues #8608, #8609, #8610.
Discovered incidentally while running the full local gate for #8588: test/unit/check-ui-kit-package.test.ts's own regression guard needs packages/loopover-ui-kit/dist/ to exist, but the root test:ci script never built that workspace before test:coverage -- unlike the real CI validate-tests job, which already builds it via `npx turbo run build --filter=@loopover/ui-kit` right before its own coverage step (added in #8592 to close this exact gap, but only in the CI workflow, not the local script this repo's own contributing guide points everyone at). Anyone running `npm run test:ci` from a clean checkout hit a spurious failure that real CI never showed. Adds `npm run build --workspace @loopover/ui-kit` alongside the other per-package builds already in the chain (engine, discovery-index, mcp, miner), so the local script matches CI again.
Discovered incidentally while running the full local gate for #8588: test/unit/mcp-cli-profiles.test.ts's changelog test started failing with a JSON parse error once packages/loopover-mcp/CHANGELOG.md grew past the OS pipe buffer size (verified: `loopover-mcp changelog --json | wc -c` returned exactly 65536 bytes instead of the real 65603+ -- the classic 64KB pipe-buffer boundary). Root cause: process.stdout/stderr writes to a POSIX pipe are asynchronous, but the CLI entrypoint called process.exit() immediately after the command's async work resolved, cutting off any pending write larger than one pipe buffer's worth before it finished flushing. This silently truncates any command's output over ~64KB for any real consumer piping the CLI (not just this test) -- e.g. `loopover-mcp changelog --json | jq` would get invalid JSON. Fix: drain both streams (wait for their internal buffer to empty) right before calling process.exit(), instead of changing when/whether process.exit() itself is called -- keeps the existing fast-exit behavior for everything else (no risk of hanging on a lingering fetch keep-alive socket) while fixing the truncation at its actual source.
…uard Discovered incidentally while running the full local gate for #8588: this test spawns a real subprocess (node --check over every dist/bin+dist/lib file in packages/loopover-miner) -- 5.5s in isolation, but it exceeded the default 15s testTimeout once under the full suite's parallel load. Genuinely necessary real subprocess work with no redundancy to cut, matching this repo's established real-subprocess timeout-flake pattern (agent-sdk-driver.test.ts, miner-attempt-worktree .test.ts, miner-repo-clone.test.ts, #6869/#6871): raise to the same evidence-based 60000ms ceiling already used for that class of test, rather than reflexively widening without a reason.
4 tasks
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | a573c8d | Commit Preview URL Branch Preview URL |
Jul 25 2026, 07:55 AM |
Bundle ReportBundle size has no change ✅ |
loopover-orb
Bot
added
the
gittensor:bug
17 tasks
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8612 +/- ##
=======================================
Coverage 92.55% 92.55%
=======================================
Files 798 798
Lines 79850 79850
Branches 24120 24120
=======================================
Hits 73908 73908
Misses 4803 4803
Partials 1139 1139
Flags with carried forward coverage won't be shown. Click here to find out more.
|
JSONbored
added a commit
that referenced
this pull request
Jul 25, 2026
…racking sink Per the epic's revised strategy (#8286 correction, 2026-07-25): PostHog replaces Sentry directly, not a parallel-run sink. This branch's earlier commit added PostHog alongside the existing Sentry wiring; this commit finishes the swap by removing Sentry entirely. Deletes src/sentry.ts, scripts/validate-sentry-release.mjs, the @sentry/node/@sentry/cli dependencies, and the live metagraphed Sentry DSN previously baked into wrangler.jsonc's vars (a genuine cross-project entanglement -- discovery-index reporting into a different product's shared Sentry project, exactly the problem #8289 set out to fix). Removes the corresponding SENTRY_* fields from env.d.ts/WorkerEnv/ Cloudflare.Env, regenerates worker-configuration.d.ts, and drops the Sentry leg from upload-sourcemaps.ts (PostHog's inject/upload/validate flow is now the only path, no more Math.max(sentryExitCode, postHogExitCode) combining). @posthog/cli is pinned to an exact version (0.9.1, no caret) rather than a range -- its postinstall script downloads a platform binary over HTTPS with no checksum verification. Also rebases onto current main to pick up #8612's postcss/tar dependency overrides, which an earlier `npm install --workspace` in this branch had inadvertently regressed to their pre-fix versions. Closes #8289
Merged
4 tasks
JSONbored
added a commit
that referenced
this pull request
Jul 25, 2026
… + sourcemap pipeline (#8614) * feat(discovery-index): add PostHog error tracking + sourcemap pipeline as a parallel Sentry sink Adds src/posthog.ts, mirroring src/sentry.ts's shape exactly (same redaction rules, tag allowlist, capture entry points) using PostHog's documented captureException(error, distinctId, properties) API, wired into app.ts's onError handler, server.ts's unhandled-rejection/ uncaught-exception hooks and shutdown path, and worker.ts's Container env forwarding. Extends upload-sourcemaps.ts with a second, fully independent leg: posthog-cli sourcemap inject/upload with an explicit --release-version (the Docker build never copies .git, so the CLI's own git-metadata auto-detection has nothing to inspect), running after the existing, unmodified Sentry leg so an unverified interaction between the two CLIs' inject steps can't put the proven flow at risk. Adds scripts/validate-posthog-release.mjs, a narrower release-verification counterpart to validate-sentry-release.mjs -- PostHog's release model has no commits/deploys/finalize lifecycle to check, only symbol-set presence via the error_tracking/symbol_sets API. All PostHog config (POSTHOG_API_KEY/HOST/ENVIRONMENT/RELEASE for capture, POSTHOG_CLI_API_KEY/PROJECT_ID/HOST for sourcemap upload) is wired end-to-end but not yet a real wrangler.jsonc var/secret -- #7875 (a real loopover-owned PostHog project) isn't provisioned yet, so every path stays a complete no-op until then, same as an unset SENTRY_DSN. Runs fully parallel with the existing Sentry sink per the epic's gated decommission plan (#8298); nothing about the Sentry leg changes here. Closes #8289 * feat(discovery-index): remove Sentry, PostHog is now the sole error tracking sink Per the epic's revised strategy (#8286 correction, 2026-07-25): PostHog replaces Sentry directly, not a parallel-run sink. This branch's earlier commit added PostHog alongside the existing Sentry wiring; this commit finishes the swap by removing Sentry entirely. Deletes src/sentry.ts, scripts/validate-sentry-release.mjs, the @sentry/node/@sentry/cli dependencies, and the live metagraphed Sentry DSN previously baked into wrangler.jsonc's vars (a genuine cross-project entanglement -- discovery-index reporting into a different product's shared Sentry project, exactly the problem #8289 set out to fix). Removes the corresponding SENTRY_* fields from env.d.ts/WorkerEnv/ Cloudflare.Env, regenerates worker-configuration.d.ts, and drops the Sentry leg from upload-sourcemaps.ts (PostHog's inject/upload/validate flow is now the only path, no more Math.max(sentryExitCode, postHogExitCode) combining). @posthog/cli is pinned to an exact version (0.9.1, no caret) rather than a range -- its postinstall script downloads a platform binary over HTTPS with no checksum verification. Also rebases onto current main to pick up #8612's postcss/tar dependency overrides, which an earlier `npm install --workspace` in this branch had inadvertently regressed to their pre-fix versions. Closes #8289
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm auditfindings from Dependency audit cleanup: 7 pre-existing vulnerabilities + deprecation warnings #8588:postcss<=8.5.17 (path traversal in previous-sourcemap auto-loading, GHSA-r28c-9q8g-f849, high) andtar<=7.5.20 (uncontrolled recursion DoS, GHSA-r292-9mhp-454m, moderate) — both pinned viaoverridesin rootpackage.json, matching the existing pattern for this file's other transitive-dep security pins.test:ciscript was missing abuild --workspace @loopover/ui-kitstep that real CI already has (from feat(release): extend the release-due watcher + tarball pack-check to engine/miner/ui-kit #8592, but only in the workflow, not this script); theloopover-mcpCLI silently truncates any piped command output over ~64KB (a real, live bug in the published@loopover/mcppackage —process.exit()was called before an async pipe write finished flushing); and a real-subprocess test (miner-package-skeleton.test.ts) needed the same evidence-based 60s timeout already used elsewhere in this suite for genuinely slow-under-load subprocess tests.Advances #8588 (task 1 of 4) — does not close it. The other 3 tasks (eslint v10 bump,
@esbuild-kit->tsxtrace, recharts v3 migration) are unrelated, each need their own scoping, and are now tracked as sub-issues #8608, #8609, #8610.Scope
type(scope): short summaryConventional Commit format.CONTRIBUTING.mdand does not touchsite/,CNAME, or**/lovable/**.Validation
git diff --checknpm run actionlint(part ofnpm run test:ci)npm run typechecknpm run test:coveragelocally (unsharded, vianpm run test:ci) — nosrc/**lines changed by this PR, so no Codecov patch-coverage obligation; ran anyway per the full local gate.npm run test:workersnpm run build:mcpnpm run test:mcp-packnpm run ui:openapi:checknpm run ui:lintnpm run ui:typechecknpm run ui:buildnpm audit --audit-level=moderate— clean ofpostcss/tar; the remaining 5 findings are the unrelated eslint v10/brace-expansionchain, out of scope per Dependency audit cleanup: 7 pre-existing vulnerabilities + deprecation warnings #8588's own task breakdown, tracked as Bump eslint to v10 to resolve brace-expansion/minimatch DoS chain (GHSA-mh99-v99m-4gvg) #8608.loopover-mcptruncation fix is directly exercised by the existing (previously-failing)mcp-cli-profiles.test.tschangelog test, which now passes and serves as its regression test.Ran the full
npm run test:cigate three times end-to-end while fixing the incidental issues it surfaced; final run is fully green.Safety
Notes