fix(deps): node-gyp 9 to 11.5 clears critical tar alert without dropping Node 18/20; replace unpatched git-clone

Abierto
  • ¿Algo no está bien?
#98 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
66/100
Tipo de issue
Refactorización
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
git, github-actions, javascript, node.js
Área
build-system, security

Línea de trabajo

Start in package.json to change the node-gyp range from ^9.3.0 to ^11.5.0, then regenerate package-lock.json. In scripts/build-srt-sdk.js, replace the git-clone call at line 33 with spawnSync('git', ['clone', ...]) using the spawnSync import already at line 11, and remove the git-clone require at line 9. Done means npm ls tar shows no version below 7.5.19 and .github/workflows/nodejs.yml passes on all five Node rows, including 18.x and 20.x.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Problem

node-srt ships node-gyp as a runtime dependency (^9.3.0, locked 9.3.0) because the package's install script runs node-gyp rebuild on every consumer's machine. node-gyp 9 pulls tar 6.1.12, and the Dependabot alerts API reads 13 open runtime tar alerts today, one critical (GHSA-23hp-3jrh-7fpw / CVE-2026-59873, tar <= 7.5.18, fixed 7.5.19) and eight high. Separately, scripts/build-srt-sdk.js:9 requires git-clone 0.1.0, which carries GHSA-8jmw-wjr8-2x66 (CVE-2022-25900, command injection, <= 0.2.0, no patched version exists), and it runs at install time too (build-srt-sdk.js:33, clone(srtRepoPath, srtSourcePath, { checkout: srtCheckout }, ...), where srtCheckout can come from NODE_SRT_CHECKOUT).

The existing route is stuck for a reason that does not apply to every fix: dependabot PR #87 jumps node-gyp 9 -> 13, and the triage bot correctly handed it to a maintainer (comments 2026-07-30 and 2026-08-11) because node-gyp 13 requires Node >= 22.22.2, which breaks the 18.x and 20.x rows of nodejs.yml's matrix [18.x, 20.x, 22.x, 24.x, 26.x].

There is a version that does not break the matrix. npm registry, read today: [email protected] declares engines.node: "^18.17.0 || >=20.5.0" and depends on tar ^7.4.3, which resolves to a tar above 7.5.19. (12.x needs Node ^20.17, so it would drop 18.x; 10.x stays on tar 6.)

This is independent of the libSRT tracks in #89, #90, #91 and #93, which wait on an upstream Haivision/srt tag (newest is still v1.5.7, 2026-08-28). Nothing here touches SRT_CHECKOUT.

Fix (one deliverable: clear the install-time dependency exposure without dropping a supported Node version)

  1. node-gyp ^9.3.0 -> ^11.5.0 in dependencies; regenerate the lock. Then close #87 as superseded.
  2. Replace the git-clone dependency in scripts/build-srt-sdk.js with a direct spawnSync('git', ['clone', '--depth', '1', '--branch', srtCheckout, srtRepoPath, srtSourcePath]) (argument array, no shell), already imported at line 11, and drop git-clone from package.json.

Acceptance

  • npm ls tar shows no tar below 7.5.19; the critical GHSA-23hp-3jrh-7fpw and GHSA-8jmw-wjr8-2x66 read fixed in the alerts view.
  • nodejs.yml passes on all five matrix rows, including 18.x and 20.x (the row #87 broke).
  • A clean npm install still builds the addon against v1.5.5 and against an overridden NODE_SRT_CHECKOUT.

Evidence read live 2026-10-08: package.json, package-lock.json, scripts/build-srt-sdk.js, .github/workflows/nodejs.yml on master; GET /repos/Eyevinn/node-srt/dependabot/alerts; PR #87 diff and comments; npm registry metadata for node-gyp 10.3.1, 11.5.0, 12.1.0.

Lenguaje dominante
JavaScript
Estrellas
99
Forks
35
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Eyevinn/node-srt

Todos los issues de Eyevinn/node-srt

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.