Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities #13

Activity

1. claudesecuritypatcher commented on Oct 8, 2026

   

   claudesecuritypatcherbot

   on Oct 8, 2026

   More actions

   Deferred for 45 days. The Wiz posture issue 3598aa96-… is snoozed until 2026-11-22, after which it resurfaces.

   Wiz doesn't say which package this finding flags. Its siblings #11 and #12 have identical text. Here is what's on main:

   • Runtime (shipped in dist/): the JWT chain is the only high-severity problem, and Refresh JWT chain in yarn.lock: jsonwebtoken 8→9, jws 3→4 (Wiz #11) #14 fixes it with a lockfile-only change (jsonwebtoken 8→9, jws 3→4). On that branch, yarn audit --groups dependencies --level high reports 0 high and 0 critical.
   • Dev only: every other high advisory is in lint and format tooling (xo, eslint-plugin-import, eslint-plugin-typescript-sort-keys, prettier-plugin-packagejson). The affected packages are brace-expansion 1.1.x, minimatch 3, braces, picomatch, js-yaml, json5, semver, flatted, cross-spawn and lodash. These are DoS/ReDoS-class bugs, they only ever process the repo's own sources, and none of them is a supply-chain issue.

   A blanket yarn upgrade is not a clean fix. It clears most of the lint-tree highs, but it also pulls in a newer @actions/http-client whose undici/@fastify/busboy have high advisories of their own. braces <=3.0.3 has no patched release. Dependabot #10 bumps @octokit/request across a major version and is red, so it isn't a drop-in either.

   Re-evaluate once #14 has merged and Wiz has rescanned.
2. claudesecuritypatcher

   added

   wiz-remediation-deferred

   on Oct 8, 2026