From 446e9b1a5185bcfa7d331fa2a978d643e0d5d7f2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 18:32:55 +0000 Subject: [PATCH 1/2] build(deps-dev): Bump @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0 Bumps [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md) - [Commits](https://github.com/CycloneDX/cyclonedx-node-npm/compare/v5.0.0...v6.0.0) --- updated-dependencies: - dependency-name: "@cyclonedx/cyclonedx-npm" dependency-version: 6.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index ea13793..002c9f1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "packages/*" ], "devDependencies": { - "@cyclonedx/cyclonedx-npm": "5.0.0", + "@cyclonedx/cyclonedx-npm": "6.0.0", "@playwright/test": "^1.59.1", "@testing-library/jest-dom": "^6.9.1", "@testing-library/react": "^16.3.2", @@ -1534,9 +1534,9 @@ } }, "node_modules/@cyclonedx/cyclonedx-npm": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-5.0.0.tgz", - "integrity": "sha512-pEz/pqYJHQ0ZvY5xFJa+GQ5AjNL7JOEJCXCHymvKo2N1VnzKE1ROpkumduJt8a0DukQjQfBGRXouGQ9xqJtJaQ==", + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-6.0.0.tgz", + "integrity": "sha512-kpWjjV0j5y0mMHUB5dSx1hxweH8K2blSqkgdQ6eHgU7aClB4CcXGhbHtGY6WVHSo3A01Rt7WOLas/wQ1E+tBDg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 5539171..f143046 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,7 @@ "locales:review": "node scripts/review-locales.mjs" }, "devDependencies": { - "@cyclonedx/cyclonedx-npm": "5.0.0", + "@cyclonedx/cyclonedx-npm": "6.0.0", "@playwright/test": "^1.59.1", "@testing-library/jest-dom": "^6.9.1", "@testing-library/react": "^16.3.2", From c8fb672258bae0250ad8d96bbd49856a8d483f87 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Thu, 17 Sep 2026 11:37:43 -0700 Subject: [PATCH 2/2] test(deps): guard the patched CycloneDX SBOM generator Document the Windows workspace shell-injection fix and require an exact patched generator version in the manifest and all lockfile copies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2b11c4f8-c7fa-4b14-9833-5d0b1006223b --- CHANGELOG.md | 3 +++ docs/src/changelog.md | 2 ++ scripts/release-metadata.test.mjs | 21 +++++++++++++++++++++ 3 files changed, 26 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ff6900..abc8e1a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,6 +30,9 @@ ### Security +- Upgrade the pinned CycloneDX SBOM generator to 6.0.0 to fix Windows + workspace-argument shell injection (`GHSA-q69g-4hcv-6jg4`). Guard the + manifest and every lockfile copy against reintroducing a vulnerable release. - Require `@xmldom/xmldom` 0.8.15 or later in the 0.8 line for Electron packaging dependencies. This addresses the XML injection, malformed-input, and quadratic-time parsing advisories affecting the previous 0.8.13 copy. diff --git a/docs/src/changelog.md b/docs/src/changelog.md index bb8ae4a..4a2cdad 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -6,6 +6,8 @@ foundational work by theme. ## Unreleased +- **SBOM tooling security:** Pin CycloneDX npm 6.0.0 to address + `GHSA-q69g-4hcv-6jg4`, with regression coverage for resolved versions. - **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+ within the 0.8 line for Electron packaging tools, with a lockfile guard against reintroducing vulnerable copies. diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index 17c7580..d64191a 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -91,6 +91,27 @@ describe('public release metadata', () => { expect(nonPublic).toEqual([]); }); + it('pins a patched CycloneDX SBOM generator without vulnerable resolved copies', async () => { + const [packageJson, lockfile] = await Promise.all([ + read('package.json').then(JSON.parse), + read('package-lock.json').then(JSON.parse), + ]); + const dependency = '@cyclonedx/cyclonedx-npm'; + const pinned = packageJson.devDependencies[dependency]; + const version = /^(\d+)\.\d+\.\d+$/.exec(pinned); + const copies = Object.entries(lockfile.packages) + .filter(([packagePath]) => packagePath.endsWith(`node_modules/${dependency}`)); + + expect(version, pinned).not.toBeNull(); + expect(Number(version?.[1])).toBeGreaterThanOrEqual(6); + expect(lockfile.packages[''].devDependencies[dependency]).toBe(pinned); + expect(copies.length).toBeGreaterThan(0); + for (const [packagePath, metadata] of copies) { + expect(metadata.version, packagePath).toBe(pinned); + expect(metadata.dev, packagePath).toBe(true); + } + }); + it('pins patched brace-expansion versions in every supported major', async () => { const [packageJson, lockfile] = await Promise.all([ read('package.json').then(JSON.parse),