Fix highest CVEs

[LukaszKokot]

TL;DR

pnpm audit over common/config/rush/pnpm-lock.yaml drops from 88 vulnerabilities to 11, with zero newly introduced. No critical or high findings remain.

Severity	Before	After	Removed
Critical	4	0	4
High	55	0	55
Moderate	21	5	16
Low	8	6	2
Total	88	11	77

Those are per-finding counts, so an advisory hitting two copies of a package counts twice. Deduplicated, 62 distinct GHSA advisories are eliminated (3 critical, 44 high, 13 moderate, 2 low), leaving 9.

Nothing published from this repo is affected either way — every one of these is a transitive dependency of a devDependency. The production closure of the five published packages is 34 distinct names and carries no advisories at all.

Note: this raises the supported Node floor. nodeSupportedVersionRange drops ^18.12.0 and becomes ^20.9.0 || ^22.11.0 || ^24.11.0. See Node 18 below.

Solves AB#2119495

How

1. Delete devDependencies the repo no longer uses

• eslint-config-airbnb (all 8 projects) — a 2013-era package never extended by any .eslintrc; the real chain is common/scripts/.eslintrc.ts.json -> .eslintrc.ts.base.json. It was dragging in eslint@0.21.2, babel-core@5.8.38, lodash@3.10.1, json5@0.4.0 and minimatch@2.0.10. babel-eslint goes with it, also unused.
• @svgr/rollup and its svgr() call in imodel-browser/rollup.config.js — the repo contains zero .svg files, and the only .svg imports are bare @stratakit/icons specifiers that stay external and are consumed as URL strings via <Icon href={...}>. Building with and without it produces byte-identical output, so it was transforming nothing. Sole source of svgo@1.3.2 -> nth-check@1.0.2.

2. Refresh stale lockfile resolutions (no override needed)

Most findings needed no override: the declared ranges already admitted the patched versions and the lockfile was simply holding older resolutions.

Package	Was -> Now	Already allowed by
form-data	3.0.3 -> 3.0.5, 4.0.2 -> 4.0.6	superagent ^3.0.0, jsdom@20 ^4.0.0
flatted	3.3.3 -> 3.4.4	flat-cache ^3.2.9
lodash	4.17.21 -> 4.18.1	^4.0.0
picomatch	2.3.1 -> 2.3.2	anymatch ^2.0.4, @rollup/pluginutils ^2.2.2
svgo	2.8.0 -> 2.8.3	postcss-svgo ^2.7.0
fast-uri	3.0.6 -> 3.1.5	ajv ^3.0.1
immutable	5.1.1 -> 5.1.9	sass@1.86.3 ^5.0.2
js-yaml	3.14.1 -> 3.15.1, 4.1.0 -> 4.3.1	^3.13.1, ^4.1.0
minimatch	3.1.2 -> 3.1.5	fork-ts-checker-webpack-plugin ^3.0.4
ws	8.18.1 -> 8.21.3	Storybook's existing range
@babel/plugin-transform-modules-systemjs	7.25.9 -> 7.29.8	@babel/preset-env@7.29.7
serialize-javascript	6.0.2 copy removed	terser-webpack-plugin@5.6.1 no longer depends on it

3. Two manifest changes

• rollup direct devDependency floor ^2.42.4 -> ^2.80.0 in the five published packages, the only way past 2.79.2.
• The pre-existing postcss pin 8.4.31 -> 8.5.25, in globalOverrides and the five packages that pin it directly. Verified output-neutral: all 18 SCSS files compile to byte-identical CSS under both versions.

4. Overrides that are genuinely required

"xmldom": "npm:@xmldom/xmldom@0.8.13",
"tmp": "0.2.7",
"serialize-javascript": "7.1.0",
"brace-expansion@1": "1.1.18",
"brace-expansion@5": "5.0.9"

None of these is reachable by regenerating the lockfile — in each case the parent pins a range with no patched release inside it:

• xmldom is abandoned at 0.6.0 and every published version is vulnerable, so it is aliased to its maintained successor. Its only consumer is @bentley/itwin-client's SamlToken.js, which the addon's OIDC BrowserAuthorizationClient path never reaches; the alias is verified to return identical results for that file's exact xpath expressions.
• tmp is pinned at ^0.0.33 by external-editor (<- inquirer <- msw); no patched 0.0.x exists. Its only call site is tmpNameSync, which 0.2.x still provides.
• serialize-javascript is pinned at ^4.0.0 by the deprecated rollup-plugin-terser. 7.0.3 is not sufficient — the CPU-exhaustion advisory covers >=5.0.0 <7.0.5 — hence 7.1.0. Migrating to @rollup/plugin-terser would remove the need for this override.
• brace-expansion is scoped per major so each line gets its own patched release.

All are pinned exactly rather than with a caret, so a security override cannot drift.

Node 18

serialize-javascript@7.x requires node >=20.0.0 and brace-expansion@5.0.9 declares node: 20 || >=22, so clearing the last four high findings means dropping ^18.12.0 from nodeSupportedVersionRange.

This costs consumers nothing: none of the five published packages declares an engines field, and they are browser-targeted React components, so Node is only ever a build-time requirement here. The change constrains contributors building this repo, not anyone installing the packages. Node 18 has been end-of-life since April 2025, and all three workflows already run Node 20 or newer (publish 20.x, ci 24.x, deploy-storybook 20) — both new floors accept Node 20.

Advisories removed (62)

Severity	Package	GHSA	Description	Was	Now
Critical	form-data	GHSA-fjxv-7rqg-78g4	Uses unsafe random function in form-data for choosing boundary	3.0.3, 4.0.2	3.0.5 / 4.0.6
Critical	lodash	GHSA-jf85-cpcp-j695	Prototype Pollution	3.10.1	4.18.1
Critical	xmldom	GHSA-crh6-fp67-6883	Allows multiple root nodes in a DOM	0.1.31	-> @xmldom/xmldom@0.8.13
High	@babel/plugin-transform-modules-systemjs	GHSA-fv7c-fp4j-7gwp	@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input	7.25.9	7.29.8
High	brace-expansion	GHSA-3jxr-9vmj-r5cp	DoS via exponential-time expansion of consecutive non-expanding {} groups	1.1.11, 5.0.6	1.1.18 / 5.0.9
High	brace-expansion	GHSA-mh99-v99m-4gvg	DoS via unbounded expansion length causing an out-of-memory process crash	1.1.11, 5.0.6	1.1.18 / 5.0.9
High	brace-expansion	GHSA-rgw5-rvv9-x895	DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	1.1.11, 5.0.6	1.1.18 / 5.0.9
High	fast-uri	GHSA-4c8g-83qw-93j6	Vulnerable to host confusion via failed IDN canonicalization	3.0.6	3.1.5
High	fast-uri	GHSA-7p8r-x3mc-p8w7	Vulnerable to host confusion via backslash authority introducer	3.0.6	3.1.5
High	fast-uri	GHSA-q3j6-qgpj-74h6	Vulnerable to path traversal via percent-encoded dot segments	3.0.6	3.1.5
High	fast-uri	GHSA-v2hh-gcrm-f6hx	Vulnerable to host confusion via literal backslash authority delimiter	3.0.6	3.1.5
High	fast-uri	GHSA-v39h-62p7-jpjc	Vulnerable to host confusion via percent-encoded authority delimiters	3.0.6	3.1.5
High	flatted	GHSA-25h7-pfq9-p65f	Vulnerable to unbounded recursion DoS in parse() revive phase	3.3.3	3.4.4
High	flatted	GHSA-rf6f-7fwh-wjgh	Prototype Pollution via parse() in NodeJS flatted	3.3.3	3.4.4
High	form-data	GHSA-hmw2-7cc7-3qxx	CRLF injection in form-data via unescaped multipart field names and filenames	3.0.3, 4.0.2	3.0.5 / 4.0.6
High	immutable	GHSA-v56q-mh7h-f735	Immutable.js List 32-bit trie overflow → unrecoverable DoS	5.1.1	5.1.9
High	immutable	GHSA-wf6x-7x77-mvgw	Is vulnerable to Prototype Pollution	5.1.1	5.1.9
High	immutable	GHSA-xvcm-6775-5m9r	Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set	5.1.1	5.1.9
High	js-yaml	GHSA-52cp-r559-cp3m	YAML merge-key chains can force quadratic CPU consumption	3.14.1, 4.1.0	3.15.1 / 4.3.1
High	js-yaml	GHSA-5p4m-2wfm-xmqj	Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported	3.14.1, 4.1.0	3.15.1 / 4.3.1
High	json5	GHSA-9c47-m6qq-7p4h	Prototype Pollution in JSON5 via Parse Method	0.4.0	removed
High	lodash	GHSA-35jh-r3h4-6jhm	Command Injection	3.10.1	4.18.1
High	lodash	GHSA-4xc9-xhrj-v574	Prototype Pollution	3.10.1	4.18.1
High	lodash	GHSA-p6mc-m468-83gw	Prototype Pollution	3.10.1	4.18.1
High	lodash	GHSA-r5fr-rjxr-66jc	Vulnerable to Code Injection via _.template imports key names	4.17.21	4.18.1
High	minimatch	GHSA-23c5-xmqv-rm74	Minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	2.0.10, 3.1.2	3.1.5
High	minimatch	GHSA-3ppc-4f35-3m26	Has a ReDoS via repeated wildcards with non-matching literal in pattern	2.0.10, 3.1.2	3.1.5
High	minimatch	GHSA-7r86-cg39-jmmj	Has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	2.0.10, 3.1.2	3.1.5
High	minimatch	GHSA-f8q6-p94x-37v3	Minimatch ReDoS vulnerability	2.0.10	3.1.5
High	minimatch	GHSA-hxm2-r34f-qmc5	Regular Expression Denial of Service	2.0.10	3.1.5
High	nanoid	GHSA-28wg-ghj8-5hjv	Non-secure generators can loop indefinitely with negative size	3.3.11	3.3.11
High	nanoid	GHSA-2v37-7h3g-55p8	Custom generators can loop indefinitely when size is zero	3.3.11	3.3.11
High	nth-check	GHSA-rp65-9cf3-cjxr	Inefficient Regular Expression Complexity	1.0.2	removed
High	picomatch	GHSA-c2c7-rcm5-vvqj	Has a ReDoS vulnerability via extglob quantifiers	2.3.1	2.3.2
High	postcss	GHSA-6g55-p6wh-862q	Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments	8.4.31	8.5.25
High	postcss	GHSA-r28c-9q8g-f849	Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure	8.4.31	8.5.25
High	rollup	GHSA-mw96-cpmx-2vgc	Rollup 4 has Arbitrary File Write via Path Traversal	2.79.2	2.80.0
High	serialize-javascript	GHSA-5c6j-r48x-rmvq	Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()	4.0.0, 6.0.2	7.1.0
High	svgo	GHSA-2p49-hgcm-8545	SVGO removeScripts plugin leaves some executable scripts intact	1.3.2, 2.8.0	2.8.3
High	svgo	GHSA-xpqw-6gx7-v673	SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)	2.8.0	2.8.3
High	tmp	GHSA-ph9p-34f9-6g65	Has Path Traversal via unsanitized prefix/postfix that enables directory escape	0.0.33	0.2.7
High	ws	GHSA-96hv-2xvq-fx4p	Memory exhaustion DoS from tiny fragments and data chunks	8.18.1	8.21.3
High	xmldom	GHSA-2v35-w6hq-6mfw	Uncontrolled recursion in XML serialization leads to DoS	0.1.31	-> @xmldom/xmldom@0.8.13
High	xmldom	GHSA-f6ww-3ggp-fr8h	Has XML injection through unvalidated DocumentType serialization	0.1.31	-> @xmldom/xmldom@0.8.13
High	xmldom	GHSA-j759-j44w-7fr8	Has XML node injection through unvalidated comment serialization	0.1.31	-> @xmldom/xmldom@0.8.13
High	xmldom	GHSA-wh4c-j3r5-mjhp	XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion	0.1.31	-> @xmldom/xmldom@0.8.13
High	xmldom	GHSA-x6wf-f3px-wcqx	Has XML node injection through unvalidated processing instruction serialization	0.1.31	-> @xmldom/xmldom@0.8.13
Moderate	brace-expansion	GHSA-f886-m6hf-6m8v	Zero-step sequence causes process hang and memory exhaustion	1.1.11	1.1.18 / 5.0.9
Moderate	js-yaml	GHSA-h67p-54hq-rp68	Quadratic-complexity DoS in merge key handling via repeated aliases	3.14.1, 4.1.0	3.15.1 / 4.3.1
Moderate	js-yaml	GHSA-mh29-5h37-fv8m	Has prototype pollution in merge (<<)	3.14.1, 4.1.0	3.15.1 / 4.3.1
Moderate	lodash	GHSA-f23m-r3pf-42rh	Vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit	3.10.1, 4.17.21	4.18.1
Moderate	lodash	GHSA-fvqr-27wr-82fm	Prototype Pollution	3.10.1	4.18.1
Moderate	lodash	GHSA-xxjr-mmjv-4gpg	Has Prototype Pollution Vulnerability in _.unset and _.omit functions	4.17.21	4.18.1
Moderate	picomatch	GHSA-3v7f-55p6-f55p	Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	2.3.2
Moderate	postcss	GHSA-fxqj-rqcc-2cmp	Incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset	8.4.31	8.5.25
Moderate	postcss	GHSA-qx2v-qp2m-jg93	Has XSS via Unescaped </style> in its CSS Stringify Output	8.4.31	8.5.25
Moderate	serialize-javascript	GHSA-qj8w-gfj5-8c6v	Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects	6.0.2	7.1.0
Moderate	ws	GHSA-58qx-3vcg-4xpx	Uninitialized memory disclosure	8.18.1	8.21.3
Moderate	xmldom	GHSA-5fg8-2547-mr8q	Misinterpretation of malicious XML input	0.1.31	-> @xmldom/xmldom@0.8.13
Moderate	xmldom	GHSA-h6q6-9hqw-rwfv	Misinterpretation of malicious XML input	0.1.31	-> @xmldom/xmldom@0.8.13
Low	brace-expansion	GHSA-v6h2-p8h4-qcjw	Brace-expansion Regular Expression Denial of Service vulnerability	1.1.11	1.1.18 / 5.0.9
Low	tmp	GHSA-52f5-9888-hmc6	Allows arbitrary temporary file / directory write via symbolic link dir parameter	0.0.33	0.2.7

Verification

• rush build and rush test: 193 tests, 0 failures; Storybook static build succeeds
• rush change -v passes
• ESLint still resolves its config with eslint-config-airbnb gone: 0 errors
• Published output is byte-identical to main's across all five packages — 200 files, every SHA-256 matching, built from main's dependency set and from this branch's. That holds even though the bundler itself moved (rollup 2.79.2 -> 2.80.0) alongside the babel and postcss bumps, so consumers receive exactly the bytes they do today. Additionally smoke-tested by overriding Studio's copy with this build and running the Visualizer.
• dependencies, peerDependencies, files, exports and version unchanged in all five published packages — only devDependencies moved

Not addressed (9)

Severity	Package	Why it stays
Moderate	ajv	No in-range fix for the 6.12.6 copy
Moderate (x2), Low	qs	Transitive, no in-range fix
Moderate	yaml	1.10.2 via tooling, no in-range fix
Low	cookie	Via msw@0.27; needs an msw major upgrade
Low (x2)	webpack	buildHttp allow-list bypass; that feature is not used
Low	@babel/core	sourceMappingURL file read in a build-only tool

All 9 are dev-only — none appears in the production closure, so none reaches a consumer of these packages.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates dependency tooling and build configuration across multiple packages, primarily to address security advisories and remove obsolete lint/build dependencies.

Changes:

• Removed legacy ESLint/Babel/Airbnb config dependencies from several package manifests.
• Upgraded PostCSS to 8.5.25 across affected packages and through Rush/PNPM overrides.
• Added additional pnpm globalOverrides and introduced Rush change files for impacted packages.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/modules/storybook-auth-addon/package.json	Drops eslint-config-airbnb from devDependencies.
packages/modules/manage-versions/package.json	Drops eslint-config-airbnb; bumps postcss version.
packages/modules/imodel-browser/rollup.config.js	Removes @svgr/rollup import and plugin usage from Rollup build.
packages/modules/imodel-browser/package.json	Removes @svgr/rollup, babel-eslint, eslint-config-airbnb; bumps postcss.
packages/modules/delete-itwin/package.json	Drops eslint-config-airbnb; bumps postcss version.
packages/modules/delete-imodel/package.json	Drops eslint-config-airbnb; bumps postcss version.
packages/modules/create-imodel/package.json	Drops eslint-config-airbnb; bumps postcss version.
packages/apps/storybook/package.json	Removes legacy Bentley deps and babel-eslint/eslint-config-airbnb.
common/scripts/package.json	Removes babel-eslint and eslint-config-airbnb from script deps.
common/config/rush/pnpm-config.json	Updates postcss override and adds several additional security-related overrides.
common/changes/@itwin/manage-versions-react/lk-fix-highest-cves_2026-08-05-22-00.json	Adds Rush change file (type none).
common/changes/@itwin/imodel-browser-react/lk-fix-highest-cves_2026-08-05-22-00.json	Adds Rush change file (type none).
common/changes/@itwin/delete-itwin-react/lk-fix-highest-cves_2026-08-05-22-00.json	Adds Rush change file (type none).
common/changes/@itwin/delete-imodel-react/lk-fix-highest-cves_2026-08-05-22-00.json	Adds Rush change file (type none).
common/changes/@itwin/create-imodel-react/lk-fix-highest-cves_2026-08-05-22-00.json	Adds Rush change file (type none).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[LukaszKokot]

Good thinking about the remanining findings @ben-polinsky. I went on and did an additional pass, and this dropped the vulns to 22, so about 20 more vulns removed. Thanks!

[ben-polinsky]

Good thinking about the remanining findings @ben-polinsky. I went on and did an additional pass, and this dropped the vulns to 22, so about 20 more vulns removed. Thanks!

I have much experience with rush and cves thanks to itwinjs-core :)

[ben-polinsky]

Just to recap: 8 remaining high vulns?

[LukaszKokot]

Just to recap: 8 remaining high vulns?

Seems like it after my last audit yesterday 🙏🏻

[ben-polinsky]

Just to recap: 8 remaining high vulns?

Alright sorry to be a stickler, but looks like these should be relatively easy to resolve?

 Add Rush-wide pnpm overrides in  common/config/rush/pnpm-config.json :
•  serialize-javascript  →  7.0.3 
•  tmp  →  0.2.7 
•  brace-expansion  1.x →  1.1.18 
•  brace-expansion  5.x →  5.0.9 

[LukaszKokot]

Just to recap: 8 remaining high vulns?

Alright sorry to be a stickler, but looks like these should be relatively easy to resolve?

 Add Rush-wide pnpm overrides in  common/config/rush/pnpm-config.json :
•  serialize-javascript  →  7.0.3 
•  tmp  →  0.2.7 
•  brace-expansion  1.x →  1.1.18 
•  brace-expansion  5.x →  5.0.9 

No worries, I'll check it out. I think I refrained about brace-expansion because it moved node's base version to 20, but I'll check again to be sure.

[ben-polinsky]

No worries, I'll check it out. I think I refrained about brace-expansion because it moved node's base version to 20, but I'll check again to be sure.

No one should be using node 18.x. It (and node 20.x) are EOL (and 18.x has been EOL since Mar 27, 2025.)

https://nodejs.org/en/about/eol

[LukaszKokot]

No one should be using node 18.x. It (and node 20.x) are EOL (and 18.x has been EOL since Mar 27, 2025.)

If only it were true that no one IS using it 😅 .
I went on and dropped support for node 18. We had another batch of CVEs removed thanks to that, and only 11 left, no critical, no high anymore 🎉

[alexdunae]

Here are the supported platforms for iTwin.js, FWIW: https://www.itwinjs.org/learning/supportedplatforms/

iTwin.js 4 - Node >=18.12
iTwin.js 5 - Node >=20.11

Perhaps a question for @aruniverse if it's ok to drop Node 18 support

[ben-polinsky]

Here are the supported platforms for iTwin.js, FWIW: https://www.itwinjs.org/learning/supportedplatforms/

iTwin.js 4 - Node >=18.12 iTwin.js 5 - Node >=20.11

Perhaps a question for @aruniverse if it's ok to drop Node 18 support

iTwin.js 4.x is at EOL:

4.x End of life 2023-05-22 2025-06-13 2025-12-13 2026-06-13

https://www.itwinjs.org/learning/api-support-policies/#version-support-status

[LukaszKokot]

Hey @aruniverse 👋🏻
What should we do here? Should we merge this as is and drop support for node 18? Should we continue supporting node 18? In any case, a final approval from you will let us merge this 🙏🏻
Thanks in advance!

[aruniverse]

Go ahead and drop node 18, thats been eol for years now. Also all the pkgs in here are client side, they shouldnt need node to begin with except for testing.

You need an approval from @williamkbentley