Fix high-severity adm-zip DoS (CVE-2026-39244) — bump to 0.6.0 (REV-54) - #44
Merged
Conversation
adm-zip < 0.6.0 allocates Buffer.alloc(declared_uncompressed_size) before CRC validation with no bounds check, so a ~120-byte crafted ZIP declaring ~4GB uncompressed can exhaust memory and crash the process. 0.6.0 bounds allocation to the actual data present. Used only by extractAPK/extractAAB in script/utils/file-utils.ts via extractAllTo, which is unaffected by 0.6.0's extractEntryTo behavior change. Verified: tsc build clean, npm audit clears adm-zip, and a real ~50MB app-release.apk extracts identically (966 entries -> 922 files). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The "check" job (npm ci + build) runs on every PR targeting main and is named to satisfy the org-wide required-status-check branch protection rule. Lint runs as a separate informational job (continue-on-error) because the repo currently has pre-existing eslint errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The base eslint no-unused-vars rule is not TS-aware and falsely flagged every CommandType enum member and the ReleaseHook function-type parameter names. Switch to @typescript-eslint/no-unused-vars (plugin already installed), which correctly treats enum members and type-position parameters as used, and add ^_ ignore patterns for intentionally-unused vars/args. Also fix the one genuine issue it left: != -> !== in debug.ts (eqeqeq), and drop continue-on-error from the lint CI job now that lint is clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The base eslint no-unused-vars rule is not TS-aware and falsely flagged every CommandType enum member and the ReleaseHook function-type parameter names. Switch to @typescript-eslint/no-unused-vars (plugin already installed), which correctly treats enum members and type-position parameters as used, and add ^_ ignore patterns for intentionally-unused vars/args. Also fix the one genuine issue it left: != -> !== in debug.ts (eqeqeq), and drop continue-on-error from the lint CI job now that lint is clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Pin actions to full commit SHAs (v7.0.0) instead of mutable tags, with version comments for readability/Dependabot - Add least-privilege top-level permissions (contents: read) - Add concurrency group with cancel-in-progress to drop superseded PR runs - Add timeout-minutes guard and persist-credentials: false on checkout Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Weekly version updates for the SHA-pinned actions in .github/workflows, grouped into a single PR. Dependabot bumps the commit SHA and the accompanying version comment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ashirman
approved these changes
Jul 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the high-severity Dependabot alert on
adm-zipby bumping^0.5.16→^0.6.0.adm-zip < 0.6.0callsBuffer.alloc(declared_uncompressed_size)using the size read straight from the ZIP central-directory header — no bounds check, and before CRC validation. A crafted ~120-byte ZIP declaring ~4 GB uncompressed causes a ~33-million-to-1 allocation amplification → memory exhaustion / process crash (CVE-2026-39244).0.6.0bounds allocation to the actual data present.Exposure in this repo
adm-zipis used in exactly two spots —extractAPKandextractAABinscript/utils/file-utils.ts— bothnew AdmZip(zipPath)+zip.extractAllTo(extractTo, true)on user-supplied APK/AAB binaries duringrelease/release-react. A malicious/corrupt artifact can crash the CLI, so this is worth fixing beyond silencing Dependabot.Backward compatibility: LOW RISK
extractEntryTonow preserves subdirs (only breaking API change)extractAllTo>=14>=20.19.0✅types.d.tsnoImplicitAny:false,skipLibCheck:true, no@types/adm-zipinstalledVerification
tscbuild compiles cleannpm auditno longer flagsadm-zipapp-release.apk— 966 entries → 922 files, subdirs preserved,AndroidManifest.xml/resources.arsc/classes.dexintact, ~435 msLinear: REV-54
🤖 Generated with Claude Code