Track image-size advisories: upstream is archived, Docusaurus needs to replace it

Aperta
  • Qualcosa non va?
#482 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
javascript
Ambito
documentation, security

Direzione di ricerca

Check whether facebook/docusaurus#12231 has landed and shipped. If so, update the @docusaurus/* dependencies in docs/package.json, run npm install in docs/, and confirm image-size is absent from docs/package-lock.json. Run make docs and verify that the alert clears on the next Scorecard run.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

dependencies help wanted javascript priority: low

Two of the three findings in code scanning alert #120 are image-size, and unlike the third they cannot be fixed here. This issue keeps them visible rather than hiding them behind a suppression.

Advisory Package Installed Patched version
GHSA-5p2g-fcmc-qvqq (CVE-2025-71329) image-size 2.0.2 none
GHSA-w3rx-r6r6-pgpr (CVE-2025-71330) image-size 2.0.2 none

Both are infinite-loop denial of service: a box with a zero-valued size field in the JXL/HEIF parsers, and a zero-valued entry length in the ICNS parser. The offset never advances and the loop never exits.

Why we cannot fix it here

image-size reaches us transitively, and there is nothing to upgrade to:

  • It arrives through @docusaurus/[email protected], which requires ^2.0.2.
  • Both advisories record last_affected: 2.0.2, not a fixed version. 2.0.2 is the newest release on npm.
  • Dependabot agrees independently — alerts #17 and #18 both carry first_patched_version: null.
  • Docusaurus is already on its current release, 3.10.2.
  • The upstream repository is archived. image-size/image-size was archived with its last push on 2026-06-03, a week before these advisories were published on 2026-06-10. No fix is coming.

What actually unblocks this

Docusaurus has to stop depending on it: facebook/docusaurus#12231 — "Replace unmaintained dependency image-size with active CVEs", open since 2026-07-07, still status: needs triage.

When that lands and a Docusaurus release carries it, bumping @docusaurus/* in docs/package.json closes this issue and takes Scorecard's Vulnerabilities check to 10/10.

Exposure, so nobody panics reading the alert

Low. These are build-time dependencies of the static documentation site:

  • The Dockerfile references no node or npm, and the jar is Java only. Nothing here ships in a riptide release.
  • image-size parses images committed to this repository, which arrive through a reviewed pull request on a protected branch. The input is not attacker-controlled.
  • The realistic worst case is a hung make docs build, not anything reachable in a running riptide.

Alternatives considered

Suppressing both IDs in docs/osv-scanner.toml would take the check to 10/10 today, and Scorecard does honor that file when it sits next to the manifest. It was rejected because a suppression on a permanently unfixed advisory tends to outlive the reason for it, and because 8/10 with a visible, explained finding is more honest than 10/10 with a hidden one.

That trade-off is worth revisiting if Docusaurus #12231 stalls for a long time.

How to pick this up

  1. Check whether facebook/docusaurus#12231 has landed and shipped in a release.
  2. If so, bump @docusaurus/* in docs/package.json, run npm install in docs/, and confirm image-size is gone from docs/package-lock.json.
  3. Verify with make docs.
  4. Confirm the alert clears on the next Scorecard run.

If it has not landed, the useful contribution is upstream rather than here.

Related: #475 (OpenSSF badge), #481 (the nanoid half of the same alert).

Lingua principale
Java
Stelle
2
Fork
0
Merge medio
1g 1h
PR unite (30g)
52

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Riptide-Labs/riptide

Tutte le issue di Riptide-Labs/riptide

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.