Security: Update happy-dom and Vite to fix high-severity vulnerabilities (npm audit)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- typescript, vite
- Domain
- build-system, frontend, security
Research direction
From the intercom-frontend directory, start by running npm audit and inspect the dependency changes produced by npm audit fix. Verify that happy-dom is at least 20.8.9 and that Vite uses a patched 7.x release, then run npm test, npm run typecheck, and npm run build. Done means the requested checks pass and the listed high-severity dependency vulnerabilities are remediated.
Written by the indexing model from the issue text.
Description
Summary
npm audit reveals 5 high-severity and 6 moderate vulnerabilities in the frontend dependency tree. Two of the high-severity issues are in happy-dom (used in tests) and three are in vite (build tool).
Affected Packages
| Package | Severity | GHSA | Description |
|---|---|---|---|
happy-dom v20.7.0 |
HIGH (CVSS 7.5) | GHSA-w4gp-fjgq-3q4g | Fetch sends page-origin cookies to cross-origin targets |
happy-dom v20.7.0 |
HIGH (CVSS 8.8) | GHSA-6q6h-j7hj-3r64 | ECMAScriptModuleCompiler arbitrary code execution |
vite v7.3.1 |
HIGH | GHSA-4w7w-66w2-5vf9 | Path traversal in optimised deps |
vite v7.3.1 |
HIGH | GHSA-v2wj-q39q-566r | fs.deny bypass |
vite v7.3.1 |
HIGH | GHSA-p9ff-h696-f583 | Arbitrary file read via dev server |
flatted (indirect) |
HIGH (CVSS 7.5) | GHSA-25h7-pfq9-p65f | Unbounded recursion DoS |
minimatch (indirect) |
HIGH | GHSA-3ppc-4f35-3m26 | ReDoS via repeated wildcards |
Steps to Remediate
cd intercom-frontend
npm audit fix
# Verify happy-dom >=20.8.9, vite >=7.x.x patched version
npm test
npm run typecheck
npm run build
Notes
happy-domvulnerabilities affect test execution — a compromised test could potentially exfiltrate cookies or execute code during CI.vitepath traversal affects the dev server — ensure the dev server is never exposed on a public network interface.
Priority: HIGH
- Dominant language
- TypeScript
- Stars
- 69
- Forks
- 23
- Avg merge
- 4d 5h
- Merged PRs (30d)
- 16
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Eyevinn/intercom-frontend
-
Medium security
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Eyevinn/intercom-frontend#668 ·
-
bug enhancement good first issue Medium ready-for-dev triaged
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Eyevinn/intercom-frontend#643 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
Eyevinn/intercom-frontend#692 ·
-
Low
Difficulty 5/5 Over a week Newbie friendliness 35/100
Eyevinn/intercom-frontend#678 ·
-
Low
Difficulty 5/5 Over a week Newbie friendliness 35/100
Eyevinn/intercom-frontend#677 ·
All issues in Eyevinn/intercom-frontend
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100