fix(deps): node-gyp 9 to 11.5 clears critical tar alert without dropping Node 18/20; replace unpatched git-clone

Aperta
  • Qualcosa non va?
#98 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
66/100
Tipo di issue
Refactoring
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
git, github-actions, javascript, node.js
Ambito
build-system, security

Direzione di ricerca

Start in package.json to change the node-gyp range from ^9.3.0 to ^11.5.0, then regenerate package-lock.json. In scripts/build-srt-sdk.js, replace the git-clone call at line 33 with spawnSync('git', ['clone', ...]) using the spawnSync import already at line 11, and remove the git-clone require at line 9. Done means npm ls tar shows no version below 7.5.19 and .github/workflows/nodejs.yml passes on all five Node rows, including 18.x and 20.x.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

node-srt ships node-gyp as a runtime dependency (^9.3.0, locked 9.3.0) because the package's install script runs node-gyp rebuild on every consumer's machine. node-gyp 9 pulls tar 6.1.12, and the Dependabot alerts API reads 13 open runtime tar alerts today, one critical (GHSA-23hp-3jrh-7fpw / CVE-2026-59873, tar <= 7.5.18, fixed 7.5.19) and eight high. Separately, scripts/build-srt-sdk.js:9 requires git-clone 0.1.0, which carries GHSA-8jmw-wjr8-2x66 (CVE-2022-25900, command injection, <= 0.2.0, no patched version exists), and it runs at install time too (build-srt-sdk.js:33, clone(srtRepoPath, srtSourcePath, { checkout: srtCheckout }, ...), where srtCheckout can come from NODE_SRT_CHECKOUT).

The existing route is stuck for a reason that does not apply to every fix: dependabot PR #87 jumps node-gyp 9 -> 13, and the triage bot correctly handed it to a maintainer (comments 2026-07-30 and 2026-08-11) because node-gyp 13 requires Node >= 22.22.2, which breaks the 18.x and 20.x rows of nodejs.yml's matrix [18.x, 20.x, 22.x, 24.x, 26.x].

There is a version that does not break the matrix. npm registry, read today: [email protected] declares engines.node: "^18.17.0 || >=20.5.0" and depends on tar ^7.4.3, which resolves to a tar above 7.5.19. (12.x needs Node ^20.17, so it would drop 18.x; 10.x stays on tar 6.)

This is independent of the libSRT tracks in #89, #90, #91 and #93, which wait on an upstream Haivision/srt tag (newest is still v1.5.7, 2026-08-28). Nothing here touches SRT_CHECKOUT.

Fix (one deliverable: clear the install-time dependency exposure without dropping a supported Node version)

  1. node-gyp ^9.3.0 -> ^11.5.0 in dependencies; regenerate the lock. Then close #87 as superseded.
  2. Replace the git-clone dependency in scripts/build-srt-sdk.js with a direct spawnSync('git', ['clone', '--depth', '1', '--branch', srtCheckout, srtRepoPath, srtSourcePath]) (argument array, no shell), already imported at line 11, and drop git-clone from package.json.

Acceptance

  • npm ls tar shows no tar below 7.5.19; the critical GHSA-23hp-3jrh-7fpw and GHSA-8jmw-wjr8-2x66 read fixed in the alerts view.
  • nodejs.yml passes on all five matrix rows, including 18.x and 20.x (the row #87 broke).
  • A clean npm install still builds the addon against v1.5.5 and against an overridden NODE_SRT_CHECKOUT.

Evidence read live 2026-10-08: package.json, package-lock.json, scripts/build-srt-sdk.js, .github/workflows/nodejs.yml on master; GET /repos/Eyevinn/node-srt/dependabot/alerts; PR #87 diff and comments; npm registry metadata for node-gyp 10.3.1, 11.5.0, 12.1.0.

Lingua principale
JavaScript
Stelle
99
Fork
35
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Eyevinn/node-srt

Tutte le issue di Eyevinn/node-srt

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.