From a430171ed0b882c02c3a7ec5c39295adec20c731 Mon Sep 17 00:00:00 2001 From: G Pardhiv Varma Date: Wed, 15 Jul 2026 14:37:48 +0530 Subject: [PATCH] chore(security): pin safe @asyncapi versions (Miasma RAT advisory, #3824) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-07-14 Miasma RAT supply-chain attack published malicious versions of four @asyncapi packages. superdoc reaches @asyncapi/specs via the apps/docs devDependency mintlify -> @mintlify/common -> @asyncapi/specs. The repo is not currently exposed (the lockfile resolves only @asyncapi/specs@6.8.1, and none of the malicious versions appear), but the bad 6.11.2 is reachable: @asyncapi/parser@3.4.0 declares "@asyncapi/specs": "^6.8.0", so an unfrozen re-resolution could adopt it. Add surgical pnpm.overrides that rewrite only the exact malicious versions to their safe counterparts, for all four advisory packages. The currently-resolved 6.8.1 is untouched (no forced upgrade) and no package resolution changes; the lockfile delta is limited to the overrides section. Verified with `pnpm install --frozen-lockfile`. No credential rotation is required — no malicious version was ever installed. --- package.json | 5 +++++ pnpm-lock.yaml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/package.json b/package.json index f5ecd39e26..c517ce0f92 100644 --- a/package.json +++ b/package.json @@ -140,6 +140,11 @@ "axios": "1.18.0", "protobufjs@7": "7.6.4", "protobufjs@8": "8.6.4", + "@asyncapi/specs@6.11.2": "6.11.1", + "@asyncapi/specs@6.11.2-alpha.1": "6.11.1", + "@asyncapi/generator@3.3.1": "3.3.0", + "@asyncapi/generator-helpers@1.1.1": "1.1.0", + "@asyncapi/generator-components@0.7.1": "0.7.0", "superdoc": "workspace:*", "@superdoc-dev/react": "workspace:*", "@superdoc-dev/superdoc-yjs-collaboration": "workspace:*", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 61a090fd6d..f0b8afa3fe 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -317,6 +317,11 @@ overrides: axios: 1.18.0 protobufjs@7: 7.6.4 protobufjs@8: 8.6.4 + '@asyncapi/specs@6.11.2': 6.11.1 + '@asyncapi/specs@6.11.2-alpha.1': 6.11.1 + '@asyncapi/generator@3.3.1': 3.3.0 + '@asyncapi/generator-helpers@1.1.1': 1.1.0 + '@asyncapi/generator-components@0.7.1': 0.7.0 superdoc: workspace:* '@superdoc-dev/react': workspace:* '@superdoc-dev/superdoc-yjs-collaboration': workspace:*