API dependency auditAPI dependency audit
You
Scan the API service dependencies for known vulnerabilities.
Assistant
Two dependencies in the API service have advisories:
| Package | Severity | Fixed in | Reachable |
|---|---|---|---|
xml-parse 2.3.1 | High | 2.3.4 | Yes, in the SAML handler |
semver-lite 1.0.2 | Low | 1.0.3 | No |
I opened PR #519 that bumps both; the SAML tests pass on the new version.
You
Where exactly does the SAML handler call xml-parse?
Assistant
Only one call site uses it:
services/api/src/auth/saml.tsline 12 importsparseand runs it on every incoming SAML assertion.
That is why the advisory is reachable: the XML comes straight from an unauthenticated POST to /auth/saml/callback.
You
Do the SAML tests cover the case from the advisory?
Assistant
Yes. The suite has an entity-expansion test that failed on 2.3.1 and passes on 2.3.4, so the fix is covered.
You
Can we merge #519 today?
Assistant
PR #519 is waiting on one approval.
- CI: 14 of 14 checks green.
- Reviewer: requested from the auth owners.
I will not merge it myself until that approval lands.