Repository navigation
Assess two additional stream-json advisories in RN tooling #330
Description
Severity: Medium.
The complete recursive Yarn audits report two additional stream-json advisories in both RN certification workspaces.
The audits ran on clean source e807770da12e01947228c9e7b5bbbec2151a4884 and exited 1.
- GHSA-hqr4-qq8f-hg3x reports repeated JSONC comment scanning.
- GHSA-mjw6-4jj6-33hc reports prototype pollution in Assembler.
Both dependency trees contain stream-json 1.9.1 through Detox 20.47.0. These records differ from the depth advisory reviewed in #86.
This finding does not establish mobile application exposure. The actual Detox input and API boundaries need review.
Reproduction:
make rn-source-fixture RN_RUNTIME_VERSION=0.82.1
cd .ignore/rn-runtime/0.82.1/clients/react-native
yarn npm audit --all --recursive --jsonThe current tuple uses the same audit command after make rn-source-fixture RN_RUNTIME_VERSION=0.83.10.
Both immutable installs exit 0. The original complete audit output remains in the private local evidence directory.
Investigate whether Detox consumes the affected APIs and inputs. Select a supported compatible correction when one exists.
Do not force a major dependency replacement or suppress the advisory to produce a passing audit.
Acceptance criteria:
- Identify the concrete consumers and affected API versions for both advisories.
- Record the measured input boundary or supported dependency correction.
- Retain full audit results and any failed attempts.
- Validate an implemented correction through applicable Make gates and independent review.
Related preparation: #303 and 0.4.0-rc.2. Separate unfixed dependencies remain tracked in #312 and #328.
Activity
mdspinali commentedon Oct 10, 2026
Final source quality and audits
make ci-source-qualitypassed on cleancfdd99f7e3037c3efc7a0e6dfab7815d3bf8e666in 461 seconds.Its preserved Kotlin results contain 748 tests in 46 suites.
Its RN unit results contain 269 tests.
The structured results contain zero failures, errors, and skips.
The completed owned ADB service had zero connected devices and stopped successfully.
The configured Trivy scan passed on the same clean commit with zero SARIF findings.
Its policy is unchanged.
Both full package-manager audits returned status 1 on that clean commit.
The RN audit still reports High Braces and Moderate sprintf-js and stream-json advisories.
Deprecation reports also remain visible.
The documentation audit reports ten Moderate affected records through postcss-selector-parser.
The named compression, Handlebars, and shell-quote fixable advisories are absent.
Current upstream evidence
Official npm metadata reports Braces 3.0.3 and sprintf-js 1.1.3 as their latest versions.
Those versions remain inside their reported affected ranges.
Stream-json 3.7.0 exists, but the declared consumer ranges exclude it.
Detox 20.51.4 still declares stream-json
^1.7.4.The authored lock also contains bunyan-debug-stream 3.1.1 with stream-json
^1.7.5.The latest published stream-json 1.x version remains 1.9.1.
The full audit reports depth, JSONC comment scanning, and Assembler prototype-pollution advisories for that version.
No forced major replacement or advisory suppression was added.
Expressive Code core 0.44.2 still declares postcss-nested
^6.0.1.Postcss-nested 6.2.0 declares postcss-selector-parser
^6.1.1.The separate documentation finding remains open.
The raw audit failures and registry metadata remain preserved.
No security exception or publication approval is granted.
Related blockers: #312, #328, #330, and #319.
mdspinali commentedon Oct 11, 2026
Current consumer review
Reviewed source: clean
538e1bf7d302d098d33659cb507a2489de761159.The independent review and primary reproduction used actual installed consumers.
The complete audit remains unchanged and retains exit status 1.
JSONC advisory
The installed stream-json 1.9.1 paths use plain JSON or JSONL.
They do not contain the affected JSONC API.
Detox uses
src/logger/utils/streams/DetoxJSONLParser.js:13, which selects native JSON.parse.Bunyamin uses
StreamArray.withParser, which selects the plain JSON parser.Actual consumer probes reject authored comment syntax.
This establishes bounded non-applicability for GHSA-hqr4-qq8f-hg3x in this installation.
The malformed trace probe retains its unhandled parser error and exit status 1.
Assembler advisory
GHSA-mjw6-4jj6-33hc remains applicable to the installed trace merger.
The path is Detox 20.47.0, jest-environment-emit 1.2.0, bunyamin 1.6.3, and stream-json 1.9.1.
The actual caller is
jest-environment-emit/dist/utils/logger.js:64-84.It merges multiple trace files selected through JEST_BUNYAMIN_DIR.
The earlier dependency note incorrectly named bunyan-debug-stream as the ^1.7.5 consumer.
That dependency belongs to bunyamin.
The real merger parsed authored proto properties through Assembler.
Nested prototype replacement changed another event's normalized thread ID from 0 to 4.
An inherited timestamp also changed event order.
Benign consumer inputs and native JSON.parse twins did not produce those effects.
This evidence disproves complete non-applicability at the trace-merger API boundary.
It does not establish network access, mobile runtime exposure, or a sync protocol defect.
The review did not establish whether certification execution enables JEST_BUNYAMIN_DIR.
Reproduction and validation
node /tmp/synchro-rc2-closeout-20261011/security-review-probes.cjsThe primary inspected and reran the complete independent diagnostic probe.
It completed 61 isolated cases and 171 checks, with zero unexpected failures or skips.
The probe intentionally demonstrates vulnerable behavior. Its exit status 0 does not mean the dependency is safe.
Source remained clean and unchanged.
The report, authored inputs, observed errors, package identities, and native twins remain retained in the closeout records.
No dependency correction, scanner exclusion, or security exception was applied.
This issue remains open because the Assembler finding is unresolved.
mdspinali commentedon Oct 11, 2026
Compatible correction availability
The fresh authoritative GHSA-mjw6-4jj6-33hc record identifies 3.6.0 as the first patched stream-json version.
Its affected range is <3.6.0.
The official registry currently selects stream-json 3.7.0 as latest.
Latest published bunyamin remains 1.6.3 and requires stream-json ^1.7.5.
That parent range excludes the patched major.
The installed consumer therefore remains on vulnerable stream-json 1.9.1.
The actual trace-merger reproduction in comment 6113284090 remains unresolved.
No compatible parent or leaf correction was identified.
The issue prohibits forcing a transitive major to clear the audit.
No such override, scanner suppression, or risk exception was applied.
The JSONC advisory disposition remains separate from this applicable Assembler defect.
The fresh registry metadata and full advisory response remain retained in the closeout records.
mdspinali commentedon Oct 12, 2026
Selected compatible repair
The user renewed the request to complete all repairs and publication.
The repair will preserve package versions, parent ranges, and full audit output.
For #312, the CLI will escape the documented jsSrcsDir directory before appending its fixed source-extension glob.
The installed Fast-glob convertPathToPattern API provides the required literal-path behavior.
The correction changes the concrete directory-to-pattern boundary that reproduced the defect.
It preserves traversal, file reads, exclusions, and duplicate handling.
The overlength invalid directory still encounters a bounded existing input-length error.
That measured error is SyntaxError, not RangeError.
No new depth cap, blanket error suppression, or fabricated empty result will be added.
Literal special-character directories and neighboring decoys will provide semantic proof.
The same proof must fail when escaping is removed.
The remaining supported Braces consumer inputs still require source-flow classification before closure.
For #330, the repair will backport the property-write logic from upstream commit 2f2d35bbb547306991ded6487a279154d865a358.
Both Assembler 1.9.1 write paths will create own proto data properties with native JSON property attributes.
Other assignments, reviver invocation, arrays, and public API behavior will remain unchanged.
The actual trace merger must preserve correct thread remapping and event order.
Normal and reviver controls must reject omission of either corrected assignment.
The JSONC non-applicability disposition remains separate.
Each correction will have one canonical, version-bound patch asset.
Yarn workspaces will use the supported patch protocol.
Published package assets and an explicit setup command will deliver the same correction to npm consumers.
Both public and prepublication consumer paths must use the delivered patch before affected commands.
Version, source preimage, postimage, and patch identities must be checked.
Fresh installation must not restore unpatched bytes without detection.
Independent design review accepts the narrow source-correction shapes.
The primary selects path escaping because it preserves existing discovery behavior with the smallest change.
Changing traversal cwd would require additional absolute-path and exclusion decisions.
Implementation, independent final review, and applicable Make gates remain required.
No issue closes from this proposed design, and no security exception is authorized.
mdspinali commentedon Oct 12, 2026
Fixed in
e1423464c28db134e1b388549d9be6951ba777e7through #337.Change
Detox 20.47.0 reaches
bunyamin1.6.3 andstream-json1.9.1 through its trace tooling.Bunyamin's JSON trace path uses
StreamArrayandAssembler.The original Assembler assignments let
__proto__data change object prototypes and inherited trace fields.The canonical patch backports upstream commit
2f2d35bbb547306991ded6487a279154d865a358for both Assembler assignments.It creates an own JSON data property instead of invoking the prototype setter.
It preserves the installed 1.9.1 reviver receiver and ordinary property behavior.
Yarn and the delivered npm setup helper use the same patch.
Parent versions and ranges remain unchanged. No incompatible major replacement applies.
The separate JSONC advisory is not applicable to the installed consumer.
Version 1.9.1 does not expose the affected JSONC parser API.
Detox's JSONL reader uses native
JSON.parse. Bunyamin's reviewed trace path parses ordinary JSON.The measured Assembler exposure is corrected rather than dismissed as development tooling.
Validation
Clean source:
83a5d05ebe0f3ca6baa454285f466c7b202e526b.make test-rn-tooling-security: four tests pass on macOS and Linux, with zero failures or skips.tid0 and retains prototype-named data as an own property.abf8f846c6d1758b90f70e4cc54504ba28b294d4fails the JSON semantic assertion.5c7f258d9abcf6d66d107ce36d35975cde2e0739fails the same assertion through the separate branch.make test-rn-tooling-package: the exact packaged test passes on both hosts, with zero failures or skips.41ce71da69b2e4a025744656dc3b0c7f645081a4.The reviewed source, checked merge, and integrated dev commit have tree
948384ec557d7921f6678e7587673b93fea8abcf.The complete recursive audit on clean
1b7922d00f87792406e92db836e123699f62b2a2retains exit 1 without exclusions.Its inputs are unchanged at the final source. The version-based records remain visible despite the measured backport.
Earlier failed attempts and the separate depth-advisory disposition in #86 remain unchanged.
Release Candidate and sealed Package checks remain separate required publication conditions.
mdspinali commentedon Oct 12, 2026
Dependabot run 38262690499 recorded
security_update_not_possibleon source2cfd2df1746aa8401a8c6b07cf3e3e9e130e704d.The updater reports
1.9.1as the latest resolvable version and3.6.0as the first version outside its advisory ranges.Its constraints are Bunyamin 1.6.3
^1.7.5and Detox 20.47.0^1.7.4.The current alerts are the same records covered by this issue:
GHSA-mjw6-4jj6-33hc: Assembler property assignment. The reviewed upstream backport corrects both assignment branches.GHSA-hqr4-qq8f-hg3x: JSONC parser rescanning. The installed 1.9.1 consumer has no affected JSONC API.This updater failure records an unresolved version replacement. It does not execute the patched Assembler or demonstrate a new consumer defect.
The version-based records remain visible. The parent versions, ranges, canonical patch, and measured applicability are unchanged.
PR #341 passed all required checks in CI 38262497216.
Current master
cbb4630a880925b3bb9cfccfb34413f41c648752has started its separate full Candidate run.The original updater failure remains retained with its actual result.
mdspinali commentedon Oct 13, 2026
Dependabot run 38463971195 failed on master
baa1b418f9e0481037179d15683526faf5c35d87.The retained updater result is
security_update_not_possibleforstream-json.It reports latest resolvable version
1.9.1and lowest non-vulnerable version3.6.0.These are the same version constraints recorded in the previous updater failure above.
The complete comparison from
cbb4630atobaa1b418found no changes in these inputs:clients/react-native/package.jsonclients/react-native/yarn.lockclients/react-native/.yarn/patchesThis updater did not execute the reviewed Assembler backport or identify a new consumer defect.
The required dependency scan passed on the exact master commit.
The automatic version replacement remains unavailable and visible.
No advisory, updater failure, or required gate was suppressed.
The current Candidate CI remains separate and active in run
38463766539.This evidence does not claim Candidate or release completion.
mdspinali commentedon Oct 14, 2026
Current RC2 advisory check
GitHub still reports three moderate alerts on master
a0903e2be1a3f6bf38ae31c59b82ba0b9f336142.They are the same version-based records covered by #328 and #330.
GHSA-hp3w-g68c-fv3c, concernssprintf-jsprecision formats.GHSA-hqr4-qq8f-hg3x, concerns JSONC rescanning.GHSA-mjw6-4jj6-33hc, concerns Assembler property assignment.The complete lock blocks for the NYC loader, js-yaml, Argparse, and sprintf-js equal the blocks reviewed at
538e1bf7.Current consumer changes add strict lifecycle inputs and the reviewed tooling patch application.
They add no configuration-to-Argparse format declaration boundary.
The supported-input disposition in #328 therefore retains its recorded source boundary and negative controls.
The release source retains the canonical Assembler correction for both assignment branches.
Its actual Detox/Bunyamin consumer proof remains in
scripts/ci/rn_tooling_security_probe.cjs.The installed stream-json 1.9.1 consumer still has no affected JSONC API, as recorded above.
The current complete source-quality and dependency gates passed in Candidate attempt 2.
The alerts remain visible. No advisory is dismissed or represented as removed by a version update.
This check introduces no new code, dependency update, audit exclusion, or repeated local test run.