From 9b3d8948ca40e5a61213e61d8b20e8ab7a467ffb Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 9 May 2026 21:25:52 +0000 Subject: [PATCH 1/3] fix: upgrade socks to ^2.8.9 to address CVE-2026-42338 in ip-address Co-authored-by: Brendan Kellam --- package.json | 3 ++- yarn.lock | 35 +++++++++-------------------------- 2 files changed, 11 insertions(+), 27 deletions(-) diff --git a/package.json b/package.json index 63eae0429..b504a3f79 100644 --- a/package.json +++ b/package.json @@ -59,6 +59,7 @@ "smol-toml@npm:^1.6.0": "^1.6.1", "teeny-request@npm:^10.0.0": "^10.1.2", "uuid": "^14.0.0", - "fast-uri@npm:^3.0.1": "^3.1.2" + "fast-uri@npm:^3.0.1": "^3.1.2", + "socks": "^2.8.9" } } diff --git a/yarn.lock b/yarn.lock index 0f7a4f949..6eb18b44c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -14932,13 +14932,10 @@ __metadata: languageName: node linkType: hard -"ip-address@npm:^9.0.5": - version: 9.0.5 - resolution: "ip-address@npm:9.0.5" - dependencies: - jsbn: "npm:1.1.0" - sprintf-js: "npm:^1.1.3" - checksum: 10c0/331cd07fafcb3b24100613e4b53e1a2b4feab11e671e655d46dc09ee233da5011284d09ca40c4ecbdfe1d0004f462958675c224a804259f2f78d2465a87824bc +"ip-address@npm:^10.1.1": + version: 10.2.0 + resolution: "ip-address@npm:10.2.0" + checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a languageName: node linkType: hard @@ -15469,13 +15466,6 @@ __metadata: languageName: node linkType: hard -"jsbn@npm:1.1.0": - version: 1.1.0 - resolution: "jsbn@npm:1.1.0" - checksum: 10c0/4f907fb78d7b712e11dea8c165fe0921f81a657d3443dde75359ed52eb2b5d33ce6773d97985a089f09a65edd80b11cb75c767b57ba47391fee4c969f7215c96 - languageName: node - linkType: hard - "jsdom@npm:^25.0.1": version: 25.0.1 resolution: "jsdom@npm:25.0.1" @@ -20574,13 +20564,13 @@ __metadata: languageName: node linkType: hard -"socks@npm:^2.8.3": - version: 2.8.4 - resolution: "socks@npm:2.8.4" +"socks@npm:^2.8.9": + version: 2.8.9 + resolution: "socks@npm:2.8.9" dependencies: - ip-address: "npm:^9.0.5" + ip-address: "npm:^10.1.1" smart-buffer: "npm:^4.2.0" - checksum: 10c0/00c3271e233ccf1fb83a3dd2060b94cc37817e0f797a93c560b9a7a86c4a0ec2961fb31263bdd24a3c28945e24868b5f063cd98744171d9e942c513454b50ae5 + checksum: 10c0/2d4350c31142b0931eb1758825b426bcbf4bfb5eed682ca48bc46dc9e7d1930ec366ea574ad49fc6c1fd9e9e17ce243be0ef13e31fc4b0319d9093f1fb19743c languageName: node linkType: hard @@ -20652,13 +20642,6 @@ __metadata: languageName: node linkType: hard -"sprintf-js@npm:^1.1.3": - version: 1.1.3 - resolution: "sprintf-js@npm:1.1.3" - checksum: 10c0/09270dc4f30d479e666aee820eacd9e464215cdff53848b443964202bf4051490538e5dd1b42e1a65cf7296916ca17640aebf63dae9812749c7542ee5f288dec - languageName: node - linkType: hard - "ssri@npm:^12.0.0": version: 12.0.0 resolution: "ssri@npm:12.0.0" From 56455a5115d85d93f95454372a87c31a6c36b40e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 9 May 2026 21:26:44 +0000 Subject: [PATCH 2/3] docs: add CHANGELOG entry for CVE-2026-42338 fix Co-authored-by: Brendan Kellam --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 081d4c8d6..edfcfd8e9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed blame gutter commit navigation to use the file path as it existed at the attributing commit, so clicking a blame line whose commit predates a rename resolves to the correct historical path. [#1178](https://github.com/sourcebot-dev/sourcebot/pull/1178) - Bumped transitive `fast-uri` dependency to `^3.1.2`. [#1181](https://github.com/sourcebot-dev/sourcebot/pull/1181) - Upgraded `simple-git` to `3.36.0` to address CVE-2026-6951. [#1183](https://github.com/sourcebot-dev/sourcebot/pull/1183) +- Upgraded `socks` to `^2.8.9` to address CVE-2026-42338. [#1189](https://github.com/sourcebot-dev/sourcebot/pull/1189) ### Changed - Reduced the log verbosity of the worker by changing various log messages from info to debug. [#1179](https://github.com/sourcebot-dev/sourcebot/pull/1179) From d827ec0ce460df8bb962fea140c8b2c19326c139 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Sat, 9 May 2026 15:23:41 -0700 Subject: [PATCH 3/3] fix: refresh yarn.lock to upgrade ip-address to ^10.2.0 (CVE-2026-42338) Replaces the prior socks resolution-override approach with a lockfile refresh. The existing ranges (socks: ^2.8.3 in socks-proxy-agent, express-rate-limit: ^8.2.1 in @modelcontextprotocol/sdk) already admit patched versions; the lockfile was just stale. Removed yarn.lock entries for socks@^2.8.3 and express-rate-limit@^8.2.1, then re-ran yarn install. Resulting lock pins: socks 2.8.4 -> 2.8.9 (ip-address ^9.0.5 -> ^10.1.1) express-rate-limit 8.3.2 -> 8.5.1 (ip-address 10.1.0 -> ^10.2.0) All three ip-address instances in the tree now resolve to 10.2.0 (patched). No package.json change, no resolutions override required. Also fixes the prior PR's incomplete remediation: the express-rate-limit chain still pinned ip-address@10.1.0, which is < 10.1.1 and still vulnerable per the GHSA. Co-Authored-By: Claude Opus 4.7 (1M context) --- CHANGELOG.md | 2 +- package.json | 3 +-- yarn.lock | 19 ++++++------------- 3 files changed, 8 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index edfcfd8e9..f2e57add0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed blame gutter commit navigation to use the file path as it existed at the attributing commit, so clicking a blame line whose commit predates a rename resolves to the correct historical path. [#1178](https://github.com/sourcebot-dev/sourcebot/pull/1178) - Bumped transitive `fast-uri` dependency to `^3.1.2`. [#1181](https://github.com/sourcebot-dev/sourcebot/pull/1181) - Upgraded `simple-git` to `3.36.0` to address CVE-2026-6951. [#1183](https://github.com/sourcebot-dev/sourcebot/pull/1183) -- Upgraded `socks` to `^2.8.9` to address CVE-2026-42338. [#1189](https://github.com/sourcebot-dev/sourcebot/pull/1189) +- Upgraded `ip-address` to `^10.2.0` to address CVE-2026-42338. [#1189](https://github.com/sourcebot-dev/sourcebot/pull/1189) ### Changed - Reduced the log verbosity of the worker by changing various log messages from info to debug. [#1179](https://github.com/sourcebot-dev/sourcebot/pull/1179) diff --git a/package.json b/package.json index b504a3f79..63eae0429 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,6 @@ "smol-toml@npm:^1.6.0": "^1.6.1", "teeny-request@npm:^10.0.0": "^10.1.2", "uuid": "^14.0.0", - "fast-uri@npm:^3.0.1": "^3.1.2", - "socks": "^2.8.9" + "fast-uri@npm:^3.0.1": "^3.1.2" } } diff --git a/yarn.lock b/yarn.lock index 6eb18b44c..76a095489 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13496,13 +13496,13 @@ __metadata: linkType: hard "express-rate-limit@npm:^8.2.1": - version: 8.3.2 - resolution: "express-rate-limit@npm:8.3.2" + version: 8.5.1 + resolution: "express-rate-limit@npm:8.5.1" dependencies: - ip-address: "npm:10.1.0" + ip-address: "npm:^10.2.0" peerDependencies: express: ">= 4.11" - checksum: 10c0/5b64d0691071086cdb8cfc6bcd5e761f5687cf4fabdebfe2a043ea5b4d31443637181e7be71e7ffabce76aee816daee62c1ca83250045847957da408a129f650 + checksum: 10c0/bcd89bb916376f38858b2623cc486bc9a91124ff3c7dee038fafc4c03949db72b0ddc796ade17cc43af3f16af314b689dd3c6557996d8e007791151335b0f7f7 languageName: node linkType: hard @@ -14925,14 +14925,7 @@ __metadata: languageName: node linkType: hard -"ip-address@npm:10.1.0": - version: 10.1.0 - resolution: "ip-address@npm:10.1.0" - checksum: 10c0/0103516cfa93f6433b3bd7333fa876eb21263912329bfa47010af5e16934eeeff86f3d2ae700a3744a137839ddfad62b900c7a445607884a49b5d1e32a3d7566 - languageName: node - linkType: hard - -"ip-address@npm:^10.1.1": +"ip-address@npm:^10.1.1, ip-address@npm:^10.2.0": version: 10.2.0 resolution: "ip-address@npm:10.2.0" checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a @@ -20564,7 +20557,7 @@ __metadata: languageName: node linkType: hard -"socks@npm:^2.8.9": +"socks@npm:^2.8.3": version: 2.8.9 resolution: "socks@npm:2.8.9" dependencies: