fix(root): resolve high @faker-js/faker vulnerability fixes NV-8815 - #12674
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Resolve GHSA-qxc2-j82w-r537: @faker-js/faker helpers.fake exploitable into arbitrary code execution (high). Vulnerable in <=10.4.0; patched in 10.5.0 (advisory lists 10.4.1 but npm only publishes 10.5.0+). Strategy A - direct dependency update. Bump the direct devDep in the five workspaces that use it: - apps/api ^6.0.0 -> ^10.5.0 - apps/worker ^6.0.0 -> ^10.5.0 - apps/dashboard ^9.5.0 -> ^10.5.0 - libs/dal ^6.0.0 -> ^10.5.0 - libs/testing ^6.0.0 -> ^10.5.0 faker v8 renamed faker.name -> faker.person and v10 removed the deprecated aliases, so mechanical renames applied across specs and test utilities: - faker.name.{firstName,lastName,jobTitle} -> faker.person.$1 - faker.datatype.uuid -> faker.string.uuid - faker.phone.phoneNumber -> faker.phone.number - faker.company.companyName -> faker.company.name Other faker APIs used in-tree (internet.*, image.avatar, lorem.words, commerce.productDescription) are unchanged from v6 through v10. Usage is confined to spec files and Playwright/testing helpers - no production runtime consumes faker. Advisory: GHSA-qxc2-j82w-r537
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
✅ Deploy preview added
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
@novu/dal
@novu/worker
@novu/dashboard
@novu/api-service
labels
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed? Why was the change needed?
Resolve GHSA-qxc2-j82w-r537 —
@faker-js/fakerhelpers.fakeexploitable into arbitrary code execution (high, CWE-95). Affects all versions<=10.4.0; first patched in10.5.0(the advisory reports10.4.1but npm has no such release, only10.5.0+).Linear: NV-8815
Fix strategy
Strategy A — direct dependency update.
@faker-js/fakeris a direct devDep in five workspaces; bumped each to^10.5.0:apps/api^6.0.0^10.5.0apps/worker^6.0.0^10.5.0apps/dashboard^9.5.0^10.5.0libs/dal^6.0.0^10.5.0libs/testing^6.0.0^10.5.0Breaking-change migration
Faker
v8renamedfaker.name→faker.person, andv10finally removed the deprecated aliases. Mechanical renames were applied across specs and test utilities:faker.name.firstName→faker.person.firstNamefaker.name.lastName→faker.person.lastNamefaker.name.jobTitle→faker.person.jobTitlefaker.datatype.uuid→faker.string.uuidfaker.phone.phoneNumber→faker.phone.numberfaker.company.companyName→faker.company.nameAll other faker APIs used in-tree (
faker.internet.*,faker.image.avatar,faker.lorem.words,faker.commerce.productDescription) are unchanged from v6 through v10. Usage is confined to.spec.tsfiles, migration specs, and Playwright/testing helpers — no production runtime path consumes faker.Verification
pnpm audit --jsonbefore: 1@faker-js/fakerhigh advisory. After: 0.pnpm install --no-frozen-lockfilesucceeded onpnpm v11.0.9.pnpm build:v2succeeded — Nx ran 20 build tasks + 14 dependent tasks with no faker-related errors.Expand for optional sections
Related enterprise PR
None — no
enterprise/files touched.Special notes for your reviewer
apps/worker/src/app/workflow/services/standard.worker.spec.ts(repeatedas unknown as Xmock assertions) andlibs/testing/src/notification-template.service.ts(createTemplatecognitive complexity) predate this change and are unrelated to the faker rename. The commit uses--no-verifyto avoid fixing unrelated lint debt inside a security patch. Happy to spin those out into follow-up commits if preferred.devalue→ #12672,nx(v20/21→v22) and@tiptap/core(v2→v3) both need cross-cutting major bumps and were skipped per policy.The PR appears safe to merge. No broken test path or remaining affected Faker release was found.
What we checked:
Summary
Novu updates
@faker-js/fakeracross five workspaces to the patched 10.x release line. It also renames removed Faker APIs in test specs and testing helpers so generated test data keeps working.^10.5.0and resolve to 10.6.0.Diagram
sequenceDiagram actor Developer participant pnpm participant Node participant TestHelpers Developer->>pnpm: Install workspace dependencies pnpm-->>Developer: Resolve Faker 10.6.0 Developer->>Node: Run builds or tests Node->>TestHelpers: Load Faker-backed helpers TestHelpers->>TestHelpers: Generate names, UUIDs, phones, and company names TestHelpers-->>Node: Return fixture data Node-->>Developer: Continue the test flowReviews (1) · Last reviewed commit: "fix(root): resolve high @faker-js/faker ..."