From 154713f8c2c0f81864e2cbbea149697b9eeca25b Mon Sep 17 00:00:00 2001 From: aeronauty Date: Sat, 10 Oct 2026 09:01:34 +0200 Subject: [PATCH 1/2] fix: patch image parser and docs development dependencies --- docs-site/package-lock.json | 12 ++++++------ flexfoil-ui/package-lock.json | 10 +++++----- flexfoil-ui/package.json | 2 +- flexfoil-ui/src/lib/version.ts | 7 +++++++ packages/flexfoil-python/pyproject.toml | 2 +- 5 files changed, 20 insertions(+), 13 deletions(-) diff --git a/docs-site/package-lock.json b/docs-site/package-lock.json index 63891459..6213983a 100644 --- a/docs-site/package-lock.json +++ b/docs-site/package-lock.json @@ -17629,9 +17629,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "license": "MIT", "engines": { "node": ">= 0.4" @@ -19427,9 +19427,9 @@ } }, "node_modules/websocket-driver": { - "version": "0.7.4", - "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz", - "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==", + "version": "0.7.5", + "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz", + "integrity": "sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==", "license": "Apache-2.0", "dependencies": { "http-parser-js": ">=0.5.1", diff --git a/flexfoil-ui/package-lock.json b/flexfoil-ui/package-lock.json index 85ac836b..012540a4 100644 --- a/flexfoil-ui/package-lock.json +++ b/flexfoil-ui/package-lock.json @@ -1,12 +1,12 @@ { "name": "flexfoil-ui", - "version": "1.1.0-dev", + "version": "1.1.9", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "flexfoil-ui", - "version": "1.1.0-dev", + "version": "1.1.9", "license": "MIT", "dependencies": { "ag-grid-community": "^35.1.0", @@ -5486,9 +5486,9 @@ } }, "node_modules/probe-image-size": { - "version": "7.2.3", - "resolved": "https://registry.npmjs.org/probe-image-size/-/probe-image-size-7.2.3.tgz", - "integrity": "sha512-HubhG4Rb2UH8YtV4ba0Vp5bQ7L78RTONYu/ujmCu5nBI8wGv24s4E9xSKBi0N1MowRpxk76pFCpJtW0KPzOK0w==", + "version": "7.4.0", + "resolved": "https://registry.npmjs.org/probe-image-size/-/probe-image-size-7.4.0.tgz", + "integrity": "sha512-cdEprVtZxV+awMde9X+4jILBFYh4CARxVrQaMl4wY4YcPWbul9jntXrIW95NInBDyJwcVUP3U0T6yukN8rMBaQ==", "license": "MIT", "dependencies": { "lodash.merge": "^4.6.2", diff --git a/flexfoil-ui/package.json b/flexfoil-ui/package.json index 6fea9a6a..3e0156b9 100644 --- a/flexfoil-ui/package.json +++ b/flexfoil-ui/package.json @@ -2,7 +2,7 @@ "name": "flexfoil-ui", "private": true, "license": "MIT", - "version": "1.1.4", + "version": "1.1.9", "type": "module", "scripts": { "dev": "vite", diff --git a/flexfoil-ui/src/lib/version.ts b/flexfoil-ui/src/lib/version.ts index a989e272..57459f07 100644 --- a/flexfoil-ui/src/lib/version.ts +++ b/flexfoil-ui/src/lib/version.ts @@ -28,6 +28,13 @@ export interface ChangelogEntry { } export const CHANGELOG: ChangelogEntry[] = [ + { + version: '1.1.9', + date: '2026-10-10', + items: [ + { category: 'fixed', text: 'Update the Plotly image parser and documentation development dependencies to patched security versions' }, + ], + }, { version: '1.1.4', date: '2026-04-08', diff --git a/packages/flexfoil-python/pyproject.toml b/packages/flexfoil-python/pyproject.toml index 7b57495c..0811229d 100644 --- a/packages/flexfoil-python/pyproject.toml +++ b/packages/flexfoil-python/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "maturin" [project] name = "flexfoil" -version = "1.1.6" +version = "1.1.9" description = "Airfoil analysis in Python — XFOIL-faithful solver with a local web UI" readme = "README.md" license = { text = "MIT" } From ff578e425e1cff6b82175f6d0863d75d38f2d05c Mon Sep 17 00:00:00 2001 From: aeronauty Date: Sat, 17 Oct 2026 09:04:26 +0200 Subject: [PATCH 2/2] Patch docs proxy trust dependency and document exposure --- .../docs/internals/docs-development-security.mdx | 11 +++++++++++ docs-site/package-lock.json | 6 +++--- flexfoil-ui/src/lib/version.ts | 3 ++- 3 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 docs-site/docs/internals/docs-development-security.mdx diff --git a/docs-site/docs/internals/docs-development-security.mdx b/docs-site/docs/internals/docs-development-security.mdx new file mode 100644 index 00000000..7303dd90 --- /dev/null +++ b/docs-site/docs/internals/docs-development-security.mdx @@ -0,0 +1,11 @@ +--- +title: Documentation development server security +--- + +The documentation build uses Docusaurus 3.9.2. Its local development server reaches `webpack-dev-server`, Express and `proxy-addr`; the lockfile pins `proxy-addr` 2.0.8. This patch preserves the existing Express `~2.0.7` range and the same `forwarded` and `ipaddr.js` dependencies. Use `npm ci` in `docs-site/` to install the reviewed dependency graph. + +[GHSA-jqcg-44mw-7w3h](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h) describes incorrect proxy trust matching for IPv4 addresses against IPv6 subnets. In vulnerable versions, a setting such as `::ffff:10.0.0.0/8` or `::/1` can trust arbitrary IPv4 clients and accept their spoofed `X-Forwarded-For` address. Express defaults to `trust proxy=false`; the inspected Docusaurus/webpack-dev-server setup does not enable those subnet settings. Applicability therefore depends on an enabled proxy trust configuration and a consumer using the resolved IP for authorization, rate limits or logging. No such exploitable Flexfoil configuration was demonstrated. + +The patched package rejects these mismatched IPv4/IPv6 trust matches while preserving ordinary IPv4 ranges and correctly mapped IPv6 prefixes. Installed-package assertions exercise spoofed forwarding, trusted internal proxies and direct clients. These are package-boundary checks, not a complete externally exposed development-server exploit test. + +The existing deployment workflow builds static files and copies them to S3/CloudFront. This dependency is part of the docs development/build toolchain; it is not evidence that the published static site runs Express. Updating this lockfile neither deploys the site nor changes solver behavior. Other unresolved dependency alerts remain tracked separately. diff --git a/docs-site/package-lock.json b/docs-site/package-lock.json index 6213983a..05ee3661 100644 --- a/docs-site/package-lock.json +++ b/docs-site/package-lock.json @@ -16311,9 +16311,9 @@ "license": "ISC" }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", diff --git a/flexfoil-ui/src/lib/version.ts b/flexfoil-ui/src/lib/version.ts index 57459f07..e0ec050e 100644 --- a/flexfoil-ui/src/lib/version.ts +++ b/flexfoil-ui/src/lib/version.ts @@ -30,9 +30,10 @@ export interface ChangelogEntry { export const CHANGELOG: ChangelogEntry[] = [ { version: '1.1.9', - date: '2026-10-10', + date: '2026-10-17', items: [ { category: 'fixed', text: 'Update the Plotly image parser and documentation development dependencies to patched security versions' }, + { category: 'fixed', text: 'Patch proxy address validation in the documentation development server dependency' }, ], }, {