Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

web-infra-dev/rspack

              main @ c1df696
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

crates/rspack_plugin_schemes/src/http_uri/mod.rs: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Remote resource resolution during builds can be hijacked via recursive HTTP redirects, bypassing allowed URI policies to access internal network resources or trigger infinite loops.

Credential Leak: Using static NPM release credentials in build and publish scripts poses a leakage risk, requiring migration to OIDC-based trusted publishing mechanisms.

Privilege Escalation: Overly permissive default GitHub Actions token scopes increase the blast radius of a repository compromise, requiring explicit minimal permission declarations.