Skip to content

fix(deps): resolve trivy high-severity vulnerabilities #2616

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yeshamavani merged 5 commits into from
Oct 6, 2026
Merged

fix(deps): resolve trivy high-severity vulnerabilities #2616

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e220b31
fix(deps): resolve trivy high-severity vulnerabilities
piyushsinghgaur1 Oct 1, 2026
465c9b7
fix(deps): sync package-lock and package.json
piyushsinghgaur1 Oct 1, 2026
5602aec
refactor(cli): return rejected promise instead of async-throw in mcp …
piyushsinghgaur1 Oct 1, 2026
1b60987
fix(deps): cap mocha below 12 so mochawesome reporter loads
piyushsinghgaur1 Oct 1, 2026
599ce9a
fix(deps): regenerate lockfile from clean checkout to restore dropped…
piyushsinghgaur1 Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40,778 changes: 18,648 additions & 22,130 deletions package-lock.json
View file
Open in desktop

Large diffs are not rendered by default.

25 changes: 20 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@
"overrides": {
"semver": "^7.5.4",
"multer": "^2.0.2",
"mochawesome": {
"mocha": "^11.8.0"
},
"tough-cookie": "^4.1.3",
"@node-saml/node-saml": "^5.1.0",
"@loopback/cli": {
Expand All @@ -50,20 +53,32 @@
"yargs": "^17.4.1",
"form-data": "4.0.4"
},
"httpsnippet": {
"form-data": "4.0.4"
},
"form-data": "4.0.6",
"oidc-provider": {
"@koa/cors": "^5.0.0"
},
"read-package-json": {
"glob": "^10.5.0"
},
"js-yaml": "^4.3.2",

@rohit-sourcefuse rohit-sourcefuse Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one is new and unscoped, so it also forces v4 onto @oclif/core (v1 and v2 both ask for js-yaml ^3.14.1), and their table output calls yaml.safeDump, which v4 removed. Scoping it to the copies that were actually flagged keeps the fix without touching oclif:

"js-yaml@4": "^4.3.2",

"tmp": "^0.2.7",
"yeoman-environment": "^6.0.1",

@rohit-sourcefuse rohit-sourcefuse Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This override also forces v6 onto @loopback/cli (it asks for ^3.19.3), and the lockfile now has only yeoman-environment@6.3.0. @loopback/cli/lib/utils.js line 22 does require('yeoman-environment/conflicter') at load time, and v6 only exports . and ./package.json. Our app-generator, extension-generator and update-generator import LoopBack's generators, so:

$ sl microservice my-facade --facade --uniquePrefix demo
Error: Package subpath './conflicter' is not defined by "exports" in .../node_modules/yeoman-environment/package.json
Code: ERR_PACKAGE_PATH_NOT_EXPORTED

The same happens for sl extension, sl update and the Microservice MCP tool. On master the same command creates the facade.

packages/cli already depends on yeoman-environment ^6.0.1 itself, so I think this line can just be removed:

"yeoman-environment": "^6.0.1",

Without it npm nests v6 under the CLI, and @loopback/cli and yeoman-generator (peer ^3.2.0) keep their own v3. That leaves the v3 CVE on the @loopback/cli path until LoopBack supports v6, so it's worth a scoped .trivyignore entry or a note in the PR.

"yeoman-generator": {
"pacote": "^21.5.1",
"sigstore": "^4.1.1"
},
"lerna": {
"pacote": "^21.5.1"
},
"fast-xml-parser": "^5.5.6",
"lodash": "^4.18.0",
"undici": "^6.24.0",
"axios": "^1.15.2",
"tar": "^7.5.22"
"tar": "^7.5.22",
"minimatch@10": {
"brace-expansion": "^5.0.12"
},
"underscore": "^1.13.8"
},
"dependencies": {
"@lavamoat/allow-scripts": "^3.4.1",
Expand Down Expand Up @@ -94,4 +109,4 @@
"sqlite3": true
}
}
}
}
2 changes: 1 addition & 1 deletion packages/cli/.mocharc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{
"require": "ts-node/register",
"require": ["ts-node/register", "yeoman-environment"],
"spec": ["src/__tests__/**/*.ts"]
}
2 changes: 1 addition & 1 deletion packages/cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@
"tar": "^7.5.22",
"ts-morph": "^27.0.2",
"tslib": "^2.8.1",
"yeoman-environment": "^3.19.3",
"yeoman-environment": "^6.0.1",

@rohit-sourcefuse rohit-sourcefuse Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since yeoman-environment 6 is ESM only and is loaded through require(), the CLI now needs Node 22.12 or later. engines (line 19) still says "22 || 24". On Node 22.11, sl scaffold and sl mcp both fail straight away with ERR_REQUIRE_ESM from command-base.ts.

"engines": {
  "node": "^22.12.0 || 24"
},

CI uses the latest 22.x, so it won't show this.

"yeoman-generator": "^5.10.0",
"yosay": "^2.0.2",
"zod": "^4.4.3"
Expand Down
4 changes: 2 additions & 2 deletions packages/cli/src/__tests__/commands/angular-scaffold.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ describe('angular scaffold', () => {
const prompt = stub().resolves({name: ''});
const env = createStubInstance(Environment);
env.run.callsFake(
async (_namespace: string | string[], options?: RunOptions) => {
async (_namespace?: string | string[], options?: RunOptions) => {
const name = (options?.name as string | undefined) ?? '';
if (name.trim().length === 0) {
throw new Error('Project name is required');
Expand Down Expand Up @@ -52,7 +52,7 @@ describe('angular scaffold', () => {
const prompt = stub().resolves({});
const env = createStubInstance(Environment);
env.run.callsFake(
async (_namespace: string | string[], options?: RunOptions) => {
async (_namespace?: string | string[], options?: RunOptions) => {
const name = options?.name as string;
assert.equal(name, 'angular-ui');
},
Expand Down
4 changes: 2 additions & 2 deletions packages/cli/src/__tests__/commands/react-scaffold.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ describe('react scaffold', () => {
const prompt = stub().resolves({name: ''});
const env = createStubInstance(Environment);
env.run.callsFake(
async (_namespace: string | string[], options?: RunOptions) => {
async (_namespace?: string | string[], options?: RunOptions) => {
const name = (options?.name as string | undefined) ?? '';
if (name.trim().length === 0) {
throw new Error('Project name is required');
Expand Down Expand Up @@ -52,7 +52,7 @@ describe('react scaffold', () => {
const prompt = stub().resolves({});
const env = createStubInstance(Environment);
env.run.callsFake(
async (_namespace: string | string[], options?: RunOptions) => {
async (_namespace?: string | string[], options?: RunOptions) => {
const name = options?.name as string;
expect(name).to.equal('react-ui');
},
Expand Down
8 changes: 5 additions & 3 deletions packages/cli/src/command-base.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ const chalk = require('chalk'); //NOSONAR
const IGNORED_FLAGS = new Set(['help', 'cwd']);
export default abstract class CommandBase<T extends object> extends Command {
prompt: PromptFunction;
env: Environment<T>;
env: Environment;
constructor(
argv: string[],
config: IConfig,
prompt: PromptFunction,
env?: Environment<T>,
env?: Environment,
) {
super(argv, config);
if (prompt) {
Expand All @@ -48,7 +48,9 @@ export default abstract class CommandBase<T extends object> extends Command {
await this.promptFlags(generatorOptions.flags, inputs.flags);
}

this.env.register(require.resolve(`./generators/${type}`), `oclif:${type}`);
this.env.register(require.resolve(`./generators/${type}`), {
namespace: `oclif:${type}`,
});
await this.env.run(`oclif:${type}`, {
...inputs.args,
...inputs.flags,
Expand Down
2 changes: 1 addition & 1 deletion packages/cli/src/commands/mcp.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ export class Mcp extends Base<{}> {
argv: string[],
config: IConfig,
prompt: PromptFunction,
env?: Environment<AnyObject>,
env?: Environment,
cmds?: ICommandWithMcpFlags[],
) {
super(argv, config, prompt, env);
Expand Down
30 changes: 19 additions & 11 deletions packages/cli/src/utilities/mcp-adapter.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,24 @@
import {Answers} from 'yeoman-environment';
// eslint-disable-next-line @typescript-eslint/naming-convention
import TerminalAdapter from 'yeoman-environment/lib/adapter';
import type Environment from 'yeoman-environment';
import {AnyObject} from '../types';

export class McpAdapter extends TerminalAdapter {
async prompt<T extends Answers>(
questions: TerminalAdapter.Questions<T>,
answers?: T,
cb?: (answers: T) => void | Promise<void>,
) {
this.console.error(JSON.stringify(questions, undefined, 2));
throw new Error(
`The generator is expecting an input from prompt, please check the inputs`,
// In MCP / non-interactive mode a generator must never block waiting for stdin.
// yeoman-environment 6 moved TerminalAdapter into the ESM-only @yeoman/adapter
// package (not require()-able from this CommonJS CLI), so instead of subclassing
// the adapter we override prompt on the environment's own adapter.
export class McpAdapter {
install(env: Environment): void {
env.adapter.prompt = this.prompt as typeof env.adapter.prompt;
}

prompt(questions: AnyObject): Promise<never> {
// sonarignore:start
console.error(JSON.stringify(questions, undefined, 2));
// sonarignore:end
return Promise.reject(
new Error(
`The generator is expecting an input from prompt, please check the inputs`,
),
);
}
}
10 changes: 5 additions & 5 deletions packages/cli/src/utilities/yeoman.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ export async function yeomanRun(
}

function getEnv(workspace: string, name: string) {
const env = createEnv([], {cwd: workspace}, new McpAdapter({}));
const env = createEnv({cwd: workspace});
new McpAdapter().install(env);
registerGenerators(env, name);
return env;
}
Expand All @@ -29,8 +30,7 @@ async function runWithEnv(
}

function registerGenerators(env: Environment, generator: string) {
env.register(
require.resolve(`../generators/${generator}/index`),
`sl:${generator}`,
);
env.register(require.resolve(`../generators/${generator}/index`), {
namespace: `sl:${generator}`,
});
}
12 changes: 6 additions & 6 deletions packages/observability/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,11 +42,11 @@
"@loopback/core": "^7.0.3",
"@loopback/rest": "^15.0.4",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/exporter-trace-otlp-grpc": "^0.57.2",
"@opentelemetry/exporter-trace-otlp-http": "^0.57.2",
"@opentelemetry/resources": "^1.30.1",
"@opentelemetry/sdk-trace-base": "^1.30.1",
"@opentelemetry/sdk-trace-node": "^1.30.1",
"@opentelemetry/exporter-trace-otlp-grpc": "^0.222.0",
"@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
"@opentelemetry/resources": "^2.11.0",
"@opentelemetry/sdk-trace-base": "^2.11.0",
"@opentelemetry/sdk-trace-node": "^2.11.0",
"@opentelemetry/semantic-conventions": "^1.28.0",
"tslib": "^2.6.2"
},
Expand Down Expand Up @@ -101,4 +101,4 @@
"registry": "https://registry.npmjs.org/",
"access": "public"
}
}
}
8 changes: 6 additions & 2 deletions packages/observability/src/profiles/otlp.profile.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
import {Resource, detectResourcesSync} from '@opentelemetry/resources';
import {
Resource,
detectResources,
resourceFromAttributes,
} from '@opentelemetry/resources';
import {
AlwaysOffSampler,
AlwaysOnSampler,
Expand Down Expand Up @@ -57,7 +61,7 @@ function buildResource(config: ResolvedObservabilityConfig): Resource {
attributes[ATTR_DEPLOYMENT_ENVIRONMENT_NAME] = config.environment;
}

return detectResourcesSync().merge(new Resource(attributes));
return detectResources().merge(resourceFromAttributes(attributes));

@rohit-sourcefuse rohit-sourcefuse Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OTel 2 changed this quietly. In 1.x the tracer provider merged the default resource into whatever you passed in. In 2.x TracerProvider does options.resource ?? defaultResource(), so passing a resource drops telemetry.sdk.language, telemetry.sdk.name and telemetry.sdk.version. Exported spans now only carry service name, version and environment.

import {
  Resource,
  defaultResource,
  detectResources,
  resourceFromAttributes,
} from '@opentelemetry/resources';
  return defaultResource()
    .merge(detectResources())
    .merge(resourceFromAttributes(attributes));

I checked that this brings the three attributes back on 2.11. A test that reads getFinishedSpans()[0].resource.attributes from the in-memory exporter would lock it in.

}

function buildGrpcMetadata(headers: Record<string, string>) {
Expand Down
6 changes: 3 additions & 3 deletions sandbox/auth-public-private-client/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,14 +64,14 @@
"@loopback/rest": "^15.0.12",
"@loopback/rest-explorer": "^8.0.12",
"@loopback/service-proxy": "^8.0.11",
"@opentelemetry/exporter-jaeger": "^1.30.1",
"@opentelemetry/exporter-jaeger": "^2.11.0",
"@opentelemetry/plugin-dns": "^0.15.0",
"@opentelemetry/plugin-http": "^0.18.2",
"@opentelemetry/plugin-https": "^0.18.2",
"@opentelemetry/plugin-pg": "^0.15.0",
"@opentelemetry/plugin-pg-pool": "^0.15.0",
"@opentelemetry/sdk-trace-base": "^1.30.1",
"@opentelemetry/sdk-trace-node": "^1.30.1",
"@opentelemetry/sdk-trace-base": "^2.11.0",
"@opentelemetry/sdk-trace-node": "^2.11.0",
"@sourceloop/authentication-service": "^25.1.1",
"@sourceloop/core": "^21.1.1",
"dotenv": "^16.6.1",
Expand Down
11 changes: 8 additions & 3 deletions sandbox/auth-public-private-client/src/opentelemetry-registry.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ dotenvExt.load({
});

if (!!+(process.env.ENABLE_TRACING ?? 0)) {
const provider = new NodeTracerProvider();
const option = {
serviceName: process.env.SERVICE_NAME ?? '',
tags: [],
Expand All @@ -25,7 +24,13 @@ if (!!+(process.env.ENABLE_TRACING ?? 0)) {
};
// Configure span processor to send spans to the exporter
const exporter = new JaegerExporter(option);
provider.addSpanProcessor(new BatchSpanProcessor(exporter));
provider.addSpanProcessor(new BatchSpanProcessor(new ConsoleSpanExporter()));
// OTel 2.x: span processors are passed to the constructor (addSpanProcessor
// was removed).
const provider = new NodeTracerProvider({
spanProcessors: [
new BatchSpanProcessor(exporter),
new BatchSpanProcessor(new ConsoleSpanExporter()),
],
});
provider.register();
}
24 changes: 12 additions & 12 deletions sandbox/chat-notification-pubnub-example/services/notifications-service/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion sandbox/chat-notification-pubnub-example/services/notifications-service/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@
"loopback-connector-postgresql": "^7.2.3",
"loopback4-authorization": "^9.0.0",
"loopback4-notifications": "^11.0.0",
"nodemailer": "^9.0.1",
"nodemailer": "^10.0.6",
"prom-client": "^14.2.0",
"pubnub": "^7.6.3",
"socket.io-client": "^4.8.3",
Expand Down
Loading
Loading