plugin-cloud-storage: unused `find-node-modules` dependency pulls in `braces` (GHSA-vfj7-8cjw-p6xm, no patched version)
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 75/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, typescript
Research direction
The change is in packages/plugin-cloud-storage/package.json: remove find-node-modules from dependencies and @types/find-node-modules from devDependencies. First run grep -rn "find-node-modules" packages/plugin-cloud-storage to confirm nothing else uses it. Done when both entries are gone, the package still builds and its tests pass, and npm audit no longer reports the braces chain for storage-s3.
Written by the indexing model from the issue text.
Description
Describe the Bug
@payloadcms/plugin-cloud-storage declares find-node-modules as a runtime dependency, but no code in the package uses it. Because of it, every app using any @payloadcms/storage-* adapter inherits this chain:
@payloadcms/storage-s3 > @payloadcms/plugin-cloud-storage > [email protected] > [email protected] > [email protected] > [email protected]
npm audit reports 6 high findings for GHSA-vfj7-8cjw-p6xm. The advisory covers braces <= 3.0.3 and lists no patched version. The braces maintainer has rejected the report (micromatch/braces#70), so a fixed release is unlikely, and micromatch 4.0.8 / findup-sync 5.0.0 are already the latest versions. Users can't fix this with overrides.
Evidence that the dependency is unused:
main(c27fe28):find-node-modulesappears only inpackages/plugin-cloud-storage/package.json(dependenciesline 63,@types/find-node-modulesindevDependenciesline 67). GitHub code search forfind-node-modulesandfindNodeModulesfinds no other file.- Published 3.90.2: none of the 125 files in
dist/reference it. - Runtime: booting Payload 3.90.2 with
@payloadcms/storage-s3under amodule.registerHooksresolve logger resolved 5,581 modules and never loadedfind-node-modules,findup-sync,micromatchorbraces. A control run that requiredfind-node-modulesdirectly was caught by the same hook. next build(16.4.0): no.nft.jsontrace or server chunk includes any of the four packages.
Proposed fix: remove find-node-modules from dependencies and @types/find-node-modules from devDependencies in packages/plugin-cloud-storage/package.json. Happy to open the PR.
Link to the code that reproduces this issue
Reproduction Steps
npm init -y && npm i @payloadcms/[email protected]npm audit- See 6 high findings for
braces(GHSA-vfj7-8cjw-p6xm) through@payloadcms/plugin-cloud-storage>find-node-modules. grep -rn "find-node-modules" node_modules/@payloadcms/plugin-cloud-storage/distreturns nothing.
Which area(s) are affected?
plugin: cloud-storage, plugin: storage-*
Environment Info
Binaries:
Node: 24.21.0
npm: 12.2.0
Relevant Packages:
payload: 3.90.2
next: 16.4.0
@payloadcms/plugin-cloud-storage: 3.90.2
@payloadcms/storage-s3: 3.90.2
react: 19.3.0
Operating System: macOS (Darwin 27.0.0)
- Dominant language
- TypeScript
- Stars
- 45.3k
- Forks
- 4.3k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 272
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from payloadcms/payload
-
bug: Local API call with req resets req.fallbackLocale to defaultLocalePossibly taken A pull request linked to this issue is open or already merged. Openarea: core Bug created-by: Contributor
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
payloadcms/payload#18768 ·
Maintainers usually reply within 1 day
-
[plugin-multi-tenant] Infinite redirect loop with custom tenantFieldName and isGlobal collectionsPossibly taken A pull request linked to this issue is open or already merged. OpenBug plugin: multi-tenant status: needs-triage v3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
payloadcms/payload#18690 ·
Maintainers usually reply within 1 day
-
Global update drops overrideAccess, so Local API updateGlobal fails filterOptions validation (3.90 regression)Possibly taken @PINYOPATTANAWASANPORN claimed this 8 days ago. Openarea: core Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
payloadcms/payload#18674 · 1 comment ·
Maintainers usually reply within 1 day
-
db-postgres: connect() rejects its `initializing` promise with no argument, producing an unhandledRejection with reason `undefined`Possibly taken @Metehan-Bicer claimed this 10 days ago. Openarea: db-postgres Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
payloadcms/payload#18656 · 1 comment ·
Maintainers usually reply within 1 day
-
createImageSizes decodes the source once per image size, all at once, so one upload can take hundreds of MBPossibly taken @Kshot3000 claimed this 15 days ago. Openarea: core Bug Uploads
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
payloadcms/payload#18531 · 1 reaction ·
Maintainers usually reply within 1 day
All issues in payloadcms/payload
Similar issues
-
frontend
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
ranxianglei/billion-context#4172 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
awslabs/threat-composer#362 ·
Maintainers usually reply within 1 day
-
Area/Cloud Needs Triage Type/Bug
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
wso2/product-integrator#2847 ·
Maintainers usually reply within 1 day