Dependency Audit is red: pyjwt 2.14.0 (bot) and serialize-javascript 7.1.1 (frontend dev) #995

New issue

Closed

opened 2026-10-01 17:39:13 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-10-01 17:39:13 +00:00

Collaborator

The scheduled Dependency Audit failed on 1 Oct at 10:21 UTC (run https://git.rhoving.com/rbrooks/Quest-Board/actions/runs/1740, on 50f6f05). Two jobs, read from their logs:

Bot pip-audit: pyjwt 2.14.0, CVE-2026-101918, fixed in 2.15.0. The bot pulls it in through redis.
Frontend npm audit: serialize-javascript 7.1.1, GHSA-gfhx-hw2g-v5hg (XSS via an unescaped </script> in serialized function bodies). A dev dependency only, through vite-plugin-pwa → workbox-build → @rollup/plugin-terser; it runs at build time and is not shipped. Fixed in 7.1.2, which the existing ^7.0.3 range allows.

Backend pip-audit passed. No Renovate PR covers either.

Fix: pin pyjwt==2.15.0 in bot/requirements.txt and update serialize-javascript to 7.1.2 in the lockfile. No allowlist entry is needed.

The scheduled Dependency Audit failed on 1 Oct at 10:21 UTC (run https://git.rhoving.com/rbrooks/Quest-Board/actions/runs/1740, on 50f6f05). Two jobs, read from their logs: - **Bot pip-audit:** `pyjwt 2.14.0`, CVE-2026-101918, fixed in 2.15.0. The bot pulls it in through `redis`. - **Frontend npm audit:** `serialize-javascript 7.1.1`, GHSA-gfhx-hw2g-v5hg (XSS via an unescaped `</script>` in serialized function bodies). A dev dependency only, through `vite-plugin-pwa` → `workbox-build` → `@rollup/plugin-terser`; it runs at build time and is not shipped. Fixed in 7.1.2, which the existing `^7.0.3` range allows. Backend pip-audit passed. No Renovate PR covers either. **Fix:** pin `pyjwt==2.15.0` in `bot/requirements.txt` and update `serialize-javascript` to 7.1.2 in the lockfile. No allowlist entry is needed.

claude-bot referenced this issue

2026-10-01 17:39:35 +00:00

A backend worker died under load after a notifying POST (blocking calls in async handlers?) #841