fix-node

Fix Node.js CVE

Inputs

Input	Required
PACKAGE	yes
FIXED_VERSION	yes
CVE_ID	yes
REPO_DIR	yes (cwd)
NODEJS_DIRS	default . web/
USE_PNPM_WEB	default false — set true when web/ uses pnpm
PNPM_VERSION	default 10 — CI pnpm major version

Strategy

1. Direct lockfile update first (sufficient for most transitive CVEs)
2. Overrides in package.json only when update cannot reach fixed version
3. Verify lockfile shows package@<FIXED_VERSION> before commit
4. Do not commit package.json unless overrides were required

Steps

1. Update each directory

For each dir in NODEJS_DIRS with a package.json:

cd "${DIR}"

if [ "$USE_PNPM_WEB" = true ] && [ "$DIR" = "web/" ]; then
  corepack prepare "pnpm@${PNPM_VERSION}" --activate
  rm -rf node_modules
  pnpm update "${PACKAGE}@${FIXED_VERSION}" --lockfile-only 2>/dev/null || \
    pnpm update "${PACKAGE}" --lockfile-only 2>/dev/null || true
  npm update "${PACKAGE}" --package-lock-only 2>/dev/null || true
  # Fallback if lockfile-only update did not reach FIXED_VERSION:
  # python3 "${CLAUDE_PLUGIN_ROOT}/scripts/patch-pnpm-lock.py" web/pnpm-lock.yaml "$PACKAGE" "$OLD" "$FIXED"
  # Validate CI will accept the lockfile (do not use this to apply the bump):
  pnpm install --frozen-lockfile
else
  npm update "${PACKAGE}@${FIXED_VERSION}" 2>/dev/null || npm update "${PACKAGE}" 2>/dev/null || true
fi

cd "$REPO_DIR"

2. Override fallback

If lockfile version is still below FIXED_VERSION:

jq --arg pkg "$PACKAGE" --arg ver "${FIXED_VERSION}" \
  '.overrides[$pkg] = $ver | .pnpm.overrides[$pkg] = $ver' package.json > package.json.tmp && \
  mv package.json.tmp package.json
pnpm install --no-frozen-lockfile

For npm-only directories (no pnpm), use .overrides only and run npm install.

3. Verify

npm audit 2>/dev/null | grep -i "${CVE_ID}" && echo "WARNING" || echo "CVE resolved"
# For pnpm web/:
grep -E "  ${PACKAGE}@" pnpm-lock.yaml | head -3
grep -q '^overrides:' pnpm-lock.yaml || { echo "ERROR: missing overrides: header"; exit 1; }