Bug 41587 - node audit identified several vulnerable node dependencies
Summary: node audit identified several vulnerable node dependencies
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-09 17:10 UTC by Paul Derscheid
Modified: 2026-01-12 02:16 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Dependency report from Jenkins (9.78 KB, text/plain)
2026-01-09 17:10 UTC, Paul Derscheid
Details
Bug 41587: Fix critical and high severity node dependency vulnerabilities (1.37 KB, patch)
2026-01-09 17:12 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 41587: Fix moderate severity node dependency vulnerabilities (70.76 KB, patch)
2026-01-09 17:12 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 41587: Fix moderate severity node dependency vulnerabilities (1.08 KB, patch)
2026-01-09 17:22 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 41587: Fix critical and high severity node dependency vulnerabilities (1.41 KB, patch)
2026-01-09 21:12 UTC, David Nind
Details | Diff | Splinter Review
Bug 41587: Fix moderate severity node dependency vulnerabilities (1.13 KB, patch)
2026-01-09 21:12 UTC, David Nind
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Paul Derscheid 2026-01-09 17:10:20 UTC
Created attachment 191211 [details]
Dependency report from Jenkins

Koha_Main_node_audit run #121 identified several vulnerable node dependencies.

Not sure yet whether it makes more sense to attach the generated artifact or copy paste it into the summary, attached it this time. Let me know what you think.
Comment 1 Paul Derscheid 2026-01-09 17:12:38 UTC
Created attachment 191212 [details] [review]
Bug 41587: Fix critical and high severity node dependency vulnerabilities

- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)

Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 2 Paul Derscheid 2026-01-09 17:12:41 UTC
Created attachment 191213 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 3 Paul Derscheid 2026-01-09 17:15:42 UTC
Remaining moderate vulnerabilities require larger upgrades and should maybe be handled in dedicated bugs:
- postcss (requires gulp-autoprefixer/gulp-rtlcss upgrade)
- webpack-dev-server (requires Cypress 15+ upgrade path)

I also had 3 failing cypress tests:
       Spec                                              Tests  Passing  Failing  Pending  Skipped
  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ ✔  AdditionalFields_spec.ts                 00:42       12       12        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Breadcrumbs_spec.ts                      00:06        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  InfiniteScrollSelect_spec.ts             00:06        4        2        -        2        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  PatronSearchDebounce_spec.ts             00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Toolbar_spec.ts                          00:04        2        2        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  VueFramework_spec.ts                     00:26       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  flatpickr_spec.ts                        00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Acquisitions/Vendors_spec.ts             00:23        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Auth/csrf.ts                             00:19        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Admin/RecordSources_spec.ts              00:07        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Agreements_spec.ts                   00:37        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/DataProviders_spec.ts                00:33       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Dialog_spec.ts                       00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Licenses_spec.ts                     00:23        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Main.ts                              00:03        2        2        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Packages_spec.ts                     00:24        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Searchbar_spec.ts                    00:04        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/Titles_spec.ts                       00:29        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/UsageReports_spec.ts                 00:37       13       13        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  ERM/UserRoles_spec.ts                    00:04        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/CirculationHistory_spec.t      00:02        1        1        -        -        - │
  │    s                                                                                           │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/Holdings_spec.ts               00:36        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/KohaTable_spec.ts              00:21       11       11        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/OPACCirculationHistory_sp      00:27        1        1        -        -        - │
  │    ec.ts                                                                                       │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  KohaTable/PatronSearch_spec.ts           00:14        6        6        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  KohaTable/PendingHolds_spec.ts           00:02        2        -        1        -        1 │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Islands/AcquisitionsMenu_spec.ts         00:07        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Main.ts                     00:05        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Settings.ts                 00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/Trains.ts                   00:27        8        8        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Preservation/WaitingList.ts              00:08        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Patron/Address.ts                        00:02        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Patron/Format.ts                         00:18        9        9        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/Accounts.ts                         00:16        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/Institutions.ts                     00:14        5        5        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  SIP2/SystemPreferenceOverrides.ts        00:11        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  Tools/ManageMarcImport_spec.ts           00:14        3        3        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  t/api-client.ts                            0ms        -        -        1        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/commands.ts                            00:04        4        4        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/db.ts                                  102ms        1        1        -        -        - │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✖  t/insertData.ts                          00:03        8        4        1        -        3 │
  ├────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ ✔  t/mockData.ts                            511ms        8        8        -        -        - │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘
    ✖  3 of 42 failed (7%)                      10:12      208      200        3        2        4

But from Jenkins results it seems that these are preexisting ones not caused by the updates.
Comment 4 Paul Derscheid 2026-01-09 17:22:17 UTC
Created attachment 191215 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well
Comment 5 David Nind 2026-01-09 21:12:44 UTC
Created attachment 191227 [details] [review]
Bug 41587: Fix critical and high severity node dependency vulnerabilities

- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)

Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors

@RM: You will need to push yarn.lock as well

Signed-off-by: David Nind <david@davidnind.com>
Comment 6 David Nind 2026-01-09 21:12:46 UTC
Created attachment 191228 [details] [review]
Bug 41587: Fix moderate severity node dependency vulnerabilities

- Add resolution for micromatch ^4.0.8
- Add resolution for @cypress/request ^3.0.0
- Add resolution for js-yaml ^4.1.1

Test plan:
- yarn audit --level moderate should show reduced vulnerability count
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should complete without (or currently expected) errors

@RM: You will need to push yarn.lock as well

Signed-off-by: David Nind <david@davidnind.com>
Comment 7 David Nind 2026-01-09 21:14:32 UTC
Testing notes (using KTD):

Before
======

yarn audit --level high
~~~~~~~~~~~~~~~~~~~~~~~

...
31 vulnerabilities found - Packages audited: 1770
Severity: 15 Moderate | 15 High | 1 Critical
Done in 1.84s.

yarn cypress run
~~~~~~~~~~~~~~~~

Failed tests:
✖  KohaTable/PendingHolds_spec.ts
✖  Tools/ManageMarcImport_spec.ts
✖  t/api-client.ts
✖  t/insertData.ts

After
=====

yarn audit --level high
~~~~~~~~~~~~~~~~~~~~~~~

yarn audit v1.22.22
10 vulnerabilities found - Packages audited: 1654
Severity: 2 Low | 8 Moderate
Done in 3.62s

yarn cypress run
~~~~~~~~~~~~~~~~

Failed tests:
✖  KohaTable/PendingHolds_spec.ts
✖  t/api-client.ts
✖  t/insertData.ts

✖  3 of 42 failed (7%)