Fix security vulnerabilities in dependencies by ap00rv · Pull Request #437 · confluentinc/confluent-kafka-javascript

Apoorv Munshi (ap00rv) · 2026-01-26T18:54:04Z

Summary

Update @mapbox/node-pre-gyp and node-gyp to fix tar vulnerabilities (high severity)
Update AWS SDK packages to fix @smithy/config-resolver vulnerability (low severity)
Update @azure/identity and @google-cloud/kms to fix jws vulnerability (high severity)
Update node-vault to latest version

Test plan

Verify npm audit shows no vulnerabilities
Verify existing tests pass
Verify build succeeds

🤖 Generated with Claude Code

Update direct dependencies to resolve security vulnerabilities: Root package.json: - @mapbox/node-pre-gyp: ^1.0.11 → ^2.0.3 (fixes tar vulnerability) - node-gyp: ^9.3.1 → ^11.0.0 (fixes tar vulnerability) schemaregistry/package.json: - @aws-sdk/client-kms: ^3.637.0 → ^3.975.0 (fixes @smithy/config-resolver) - @aws-sdk/credential-providers: ^3.637.0 → ^3.975.0 (fixes @smithy/config-resolver) - @azure/identity: ^4.4.1 → ^4.13.0 (fixes jws vulnerability) - @google-cloud/kms: ^4.5.0 → ^5.2.1 (fixes jws vulnerability) - node-gyp: ^9.3.1 → ^11.0.0 (fixes tar vulnerability) - node-vault: ^0.10.2 → ^0.10.9 (latest version) Vulnerabilities fixed: - tar (CVE high severity) - arbitrary file overwrite - jws (CVE high severity) - improper HMAC signature verification - @smithy/config-resolver (low severity) - defense in depth enhancement - qs (high severity) - DoS via memory exhaustion - form-data (critical severity) - unsafe random function - tough-cookie (moderate severity) - prototype pollution - lodash (moderate severity) - prototype pollution - js-yaml (moderate severity) - prototype pollution Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Copilot

Pull request overview

Updates project dependencies to remediate reported security vulnerabilities (tar/jws/smithy-related) by bumping several direct packages and build tooling versions.

Changes:

Bump node-gyp (devDependency) to a newer major version.
Bump AWS SDK, Azure Identity, Google KMS libraries to newer versions.
Bump @mapbox/node-pre-gyp and node-vault to newer versions.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 6 comments.

File	Description
schemaregistry/package.json	Updates crypto/KMS-related SDK dependencies and `node-gyp`/`node-vault` to patched versions.
package.json	Updates native-build tooling dependencies (`node-gyp`, `@mapbox/node-pre-gyp`) to address tar-related vulnerabilities.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-26T18:55:29Z

package.json

    "jsdoc": "^4.0.2",
    "mocha": "^10.7.0",
-    "node-gyp": "^9.3.1",
+    "node-gyp": "^11.0.0",


These are major-version bumps and currently use caret ranges, which can introduce additional unreviewed behavior changes on future npm install (outside the lockfile). For build tooling / native-binary tooling, consider pinning to an exact version (or at least using ~) to keep builds more reproducible and upgrades more deliberate.

Suggested change

"node-gyp": "^11.0.0",

"node-gyp": "11.0.0",

Copilot · 2026-01-26T18:55:30Z

package.json

  },
  "dependencies": {
-    "@mapbox/node-pre-gyp": "^1.0.11",
+    "@mapbox/node-pre-gyp": "^2.0.3",


These are major-version bumps and currently use caret ranges, which can introduce additional unreviewed behavior changes on future npm install (outside the lockfile). For build tooling / native-binary tooling, consider pinning to an exact version (or at least using ~) to keep builds more reproducible and upgrades more deliberate.

Suggested change

"@mapbox/node-pre-gyp": "^2.0.3",

"@mapbox/node-pre-gyp": "2.0.3",

Copilot · 2026-01-26T18:55:30Z

schemaregistry/package.json

    "jsdoc": "^4.0.2",
    "mocha": "^10.7.0",
-    "node-gyp": "^9.3.1",
+    "node-gyp": "^11.0.0",


node-gyp is now declared in both the repo root and this package. In a monorepo/workspace setup this duplication can drift over time (version skew, inconsistent build behavior). Consider centralizing shared build tooling like node-gyp at the workspace root (and removing it from leaf packages) or enforcing a single version via overrides so all packages use the same node-gyp.

Suggested change

"node-gyp": "^11.0.0",

Copilot · 2026-01-26T18:55:30Z

schemaregistry/package.json

+    "@aws-sdk/client-kms": "^3.975.0",
+    "@aws-sdk/credential-providers": "^3.975.0",
+    "@azure/identity": "^4.13.0",


node-gyp is now declared in both the repo root and this package. In a monorepo/workspace setup this duplication can drift over time (version skew, inconsistent build behavior). Consider centralizing shared build tooling like node-gyp at the workspace root (and removing it from leaf packages) or enforcing a single version via overrides so all packages use the same node-gyp.

Copilot · 2026-01-26T18:55:31Z

schemaregistry/package.json

    "@criteria/json-schema": "^0.10.0",
    "@criteria/json-schema-validation": "^0.10.0",
-    "@google-cloud/kms": "^4.5.0",
+    "@google-cloud/kms": "^5.2.1",


node-gyp is now declared in both the repo root and this package. In a monorepo/workspace setup this duplication can drift over time (version skew, inconsistent build behavior). Consider centralizing shared build tooling like node-gyp at the workspace root (and removing it from leaf packages) or enforcing a single version via overrides so all packages use the same node-gyp.

Copilot · 2026-01-26T18:55:31Z

schemaregistry/package.json

    "jsonata": "^2.0.5",
    "lru-cache": "^10.4.3",
-    "node-vault": "^0.10.2",
+    "node-vault": "^0.10.9",


node-gyp is now declared in both the repo root and this package. In a monorepo/workspace setup this duplication can drift over time (version skew, inconsistent build behavior). Consider centralizing shared build tooling like node-gyp at the workspace root (and removing it from leaf packages) or enforcing a single version via overrides so all packages use the same node-gyp.

Benjamin R. Daghir (ben-daghir) · 2026-01-29T15:26:06Z

Thanks for putting this up!

A new vuln has emerged, requiring an even later version of tar

This PR:

└─┬ @creator-platform/kafka@0.1.0 -> ./packages/kafka
  └─┬ @confluentinc/kafka-javascript@1.8.1-alpha.0
    └─┬ @mapbox/node-pre-gyp@2.0.3
      └── tar@7.5.6

The Vuln:
tar <7.5.7
Severity: high
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - GHSA-34x7-hfp2-rc4v
fix available via npm audit fix
node_modules/@mapbox/node-pre-gyp/node_modules/tar
@mapbox/node-pre-gyp <=1.0.11
Depends on vulnerable versions of tar
node_modules/@mapbox/node-pre-gyp

Robert Yokota (rayokota)

Thanks Apoorv Munshi (@ap00rv) , LGTM

Tal ron (talr1) · 2026-02-08T06:41:15Z

10x for the fix. can you release a new version with it?

Apoorv Munshi (ap00rv) requested review from a team as code owners January 26, 2026 18:54

Copilot AI review requested due to automatic review settings January 26, 2026 18:54

Apoorv Munshi (ap00rv) enabled auto-merge (squash) January 26, 2026 18:54

Copilot AI reviewed Jan 26, 2026

View reviewed changes

Robert Yokota (rayokota) approved these changes Feb 6, 2026

View reviewed changes

Apoorv Munshi (ap00rv) merged commit 8071cac into master Feb 6, 2026
6 of 8 checks passed

Apoorv Munshi (ap00rv) deleted the fix/security-vulnerabilities-patch branch February 6, 2026 18:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix security vulnerabilities in dependencies#437

Fix security vulnerabilities in dependencies#437
Apoorv Munshi (ap00rv) merged 1 commit intomasterfrom
fix/security-vulnerabilities-patch

Apoorv Munshi (ap00rv) commented Jan 26, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Copilot AI Jan 26, 2026

Uh oh!

Benjamin R. Daghir (ben-daghir) commented Jan 29, 2026 •

edited

Loading

Uh oh!

Robert Yokota (rayokota) left a comment

Uh oh!

Uh oh!

Tal ron (talr1) commented Feb 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	"@mapbox/node-pre-gyp": "^2.0.3",
	"@mapbox/node-pre-gyp": "2.0.3",

Conversation

Apoorv Munshi (ap00rv) commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Benjamin R. Daghir (ben-daghir) commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Robert Yokota (rayokota) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Tal ron (talr1) commented Feb 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Apoorv Munshi (ap00rv) commented Jan 26, 2026 •

edited

Loading

Benjamin R. Daghir (ben-daghir) commented Jan 29, 2026 •

edited

Loading