Bug 41587

Summary: node audit identified several vulnerable node dependencies
Product: Koha Reporter: Paul Derscheid <paul.derscheid>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: david, dcook
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Dependency report from Jenkins
Bug 41587: Fix critical and high severity node dependency vulnerabilities
Bug 41587: Fix moderate severity node dependency vulnerabilities
Bug 41587: Fix moderate severity node dependency vulnerabilities
Bug 41587: Fix critical and high severity node dependency vulnerabilities
Bug 41587: Fix moderate severity node dependency vulnerabilities

Description Paul Derscheid 2026-01-09 17:10:20 UTC
Created attachment 191211 [details]
Dependency report from Jenkins

Koha_Main_node_audit run #121 identified several vulnerable node dependencies.

Not sure yet whether it makes more sense to attach the generated artifact or copy paste it into the summary, attached it this time. Let me know what you think.
Comment 1 Paul Derscheid 2026-01-09 17:12:38 UTC
Created attachment 191212 [details] [review]
Bug 41587: Fix critical and high severity node dependency vulnerabilities

- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)

Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 2 Paul Derscheid 2026-01-09 17:12:41 UTC
Created attachment 191213 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 3 Paul Derscheid 2026-01-09 17:15:42 UTC
Remaining moderate vulnerabilities require larger upgrades and should maybe be handled in dedicated bugs:
- postcss (requires gulp-autoprefixer/gulp-rtlcss upgrade)
- webpack-dev-server (requires Cypress 15+ upgrade path)

I also had 3 failing cypress tests:
       Spec                                              Tests  Passing  Failing  Pending  Skipped
  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ ✔  AdditionalFields_spec.ts                 00:42       12       12        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Breadcrumbs_spec.ts                      00:06        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  InfiniteScrollSelect_spec.ts             00:06        4        2        -        2        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  PatronSearchDebounce_spec.ts             00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Toolbar_spec.ts                          00:04        2        2        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  VueFramework_spec.ts                     00:26       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  flatpickr_spec.ts                        00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Acquisitions/Vendors_spec.ts             00:23        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Auth/csrf.ts                             00:19        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Admin/RecordSources_spec.ts              00:07        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Agreements_spec.ts                   00:37        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/DataProviders_spec.ts                00:33       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Dialog_spec.ts                       00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Licenses_spec.ts                     00:23        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Main.ts                              00:03        2        2        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Packages_spec.ts                     00:24        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Searchbar_spec.ts                    00:04        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Titles_spec.ts                       00:29        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/UsageReports_spec.ts                 00:37       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/UserRoles_spec.ts                    00:04        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/CirculationHistory_spec.t      00:02        1        1        -        -        - │
  │    s                                                                                           │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/Holdings_spec.ts               00:36        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/KohaTable_spec.ts              00:21       11       11        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/OPACCirculationHistory_sp      00:27        1        1        -        -        - │
  │    ec.ts                                                                                       │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/PatronSearch_spec.ts           00:14        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  KohaTable/PendingHolds_spec.ts           00:02        2        -        1        -        1 │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Islands/AcquisitionsMenu_spec.ts         00:07        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Main.ts                     00:05        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Settings.ts                 00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Trains.ts                   00:27        8        8        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/WaitingList.ts              00:08        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Patron/Address.ts                        00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Patron/Format.ts                         00:18        9        9        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/Accounts.ts                         00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/Institutions.ts                     00:14        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/SystemPreferenceOverrides.ts        00:11        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Tools/ManageMarcImport_spec.ts           00:14        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  t/api-client.ts                            0ms        -        -        1        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/commands.ts                            00:04        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/db.ts                                  102ms        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  t/insertData.ts                          00:03        8        4        1        -        3 │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/mockData.ts                            511ms        8        8        -        -        - │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘
    ✖  3 of 42 failed (7%)                      10:12      208      200        3        2        4

But from Jenkins results it seems that these are preexisting ones not caused by the updates.
Comment 4 Paul Derscheid 2026-01-09 17:22:17 UTC
Created attachment 191215 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 5 David Nind 2026-01-09 21:12:44 UTC
Created attachment 191227 [details] [review]
Bug 41587: Fix critical and high severity node dependency vulnerabilities

- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)

Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors

@RM: You will need to push yarn.lock as well

Signed-off-by: David Nind <david@davidnind.com>
Comment 6 David Nind 2026-01-09 21:12:46 UTC
Created attachment 191228 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well

Signed-off-by: David Nind <david@davidnind.com>
Comment 7 David Nind 2026-01-09 21:14:32 UTC
Testing notes (using KTD):

Before
======

yarn audit --level high
~~~~~~~~~~~~~~~~~~~~~~~

...
31 vulnerabilities found - Packages audited: 1770
Severity: 15 Moderate | 15 High | 1 Critical
Done in 1.84s.

yarn cypress run
~~~~~~~~~~~~~~~~

Failed tests:
✖  KohaTable/PendingHolds_spec.ts
✖  Tools/ManageMarcImport_spec.ts
✖  t/api-client.ts
✖  t/insertData.ts

After
=====

yarn audit --level high
~~~~~~~~~~~~~~~~~~~~~~~

yarn audit v1.22.22
10 vulnerabilities found - Packages audited: 1654
Severity: 2 Low | 8 Moderate
Done in 3.62s

yarn cypress run
~~~~~~~~~~~~~~~~

Failed tests:
✖  KohaTable/PendingHolds_spec.ts
✖  t/api-client.ts
✖  t/insertData.ts

✖  3 of 42 failed (7%)