Release JavaScript Oracle KMS Storage v1.0.0 by stas-schaller · Pull Request #873 · Keeper-Security/secrets-manager

stas-schaller · 2025-11-21T21:57:54Z

Release of @keeper-security/secrets-manager-oracle-kv v1.0.0

Oracle Cloud Key Management Service integration for secure storage of Keeper Secrets Manager configuration.

Dependencies:

@keeper-security/secrets-manager-core v17.3.0
oci-keymanagement v2.102.2
oci-vault v2.103.0

Closes https://keeper.atlassian.net/browse/KSM-705

* Bump version * fix: resolve DOM Clobbering CVE-2024-43788 (#689) * fix: resolve DOM Clobbering CVE-2024-43788 * Upgrade JavaScript tests GHA to use Node 20 * fixed moduleResolution in tsconfig updated all dependencies * Added Oracle KMS support to KSM JavaScript SDK. * fixed markdown syntax * fixed encryption issue and exception handling for get key details functionality --------- Co-authored-by: Ivan Dimov <78815270+idimov-keeper@users.noreply.github.com> Co-authored-by: satish_chandra <metron_satish@safebreach.com>

…flows

.github/workflows/publish.npm.storage.oracle.kms.yml

.github/workflows/test.javascript.storage.oracle.kms.yml

+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./sdk/javascript/packages/oracle
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+          cache-dependency-path: sdk/javascript/packages/oracle/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test


To fix this problem, add a permissions: block either at the root of the workflow file (which will apply to all jobs) or at the jobs.test level if additional jobs are added in the future with different requirements. The minimal required permission for this workflow is likely contents: read, as the workflow only checks out code and runs tests. Add this block immediately after the workflow name: and before on: (for workflow-wide settings), or at the same indentation level as runs-on: inside the test job block.

No new methods, imports, or definitions are required.

socket-security · 2025-11-21T22:01:05Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@typescript-eslint/parser@8.47.0
	npm/@types/node-fetch@2.6.13
	npm/typescript-eslint@8.47.0
	npm/fast-crc32c@2.0.0
	npm/@babel/preset-env@7.28.5
	npm/oci-vault@2.122.0
	npm/@babel/core@7.28.5
	npm/crc-32@1.2.2
	npm/@typescript-eslint/eslint-plugin@8.47.0
	npm/@types/node@22.19.1
	npm/oci-keymanagement@2.124.0
	npm/rimraf@6.1.2
	npm/node-fetch@2.7.0
	npm/pino-pretty@13.1.2
	npm/ts-jest@29.4.5
	npm/eslint@9.39.1
	npm/pino@10.1.0

View full report

…rability)

.github/workflows/publish.npm.storage.oracle.kms.yml

+    needs: generate-sbom
+    if: ${{ github.event.inputs.publish == 'true' }}
+    environment: prod
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ./sdk/javascript/packages/oracle
+
+    steps:
+      - name: Get the source code
+        uses: actions/checkout@v3
+
+      - name: Retrieve secrets from KSM
+        id: ksmsecrets
+        uses: Keeper-Security/ksm-action@master
+        with:
+          keeper-secret-config: ${{ secrets.KSM_KSM_CONFIG }}
+          secrets: |
+            NScQiZwrHJFCPv1gL8TX6Q/field/password > env:NPM_TOKEN
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build package
+        run: npm run build
+
+      - name: Publish package
+        run: npm publish


In general, the fix is to explicitly declare a permissions: block to restrict the default GITHUB_TOKEN permissions to the minimum required. For this workflow, the jobs only need to read repository contents (for actions/checkout) and do not appear to require any write scope to the GitHub API, so contents: read is sufficient.

The best fix with no functional change is to add a single permissions: block at the workflow root (right under name: or on:) so that it applies to all jobs. This avoids repetition and ensures both generate-sbom and publish-npm run with a read-only token. You only need to modify .github/workflows/publish.npm.storage.oracle.kms.yml, adding:

permissions: contents: read

near the top. No additional imports, methods, or other definitions are required.

…CVE-2025-13465 - Updates oci-keymanagement from 2.122.0 to 2.124.0 - Updates jws from 3.2.2 to 3.2.3 (via jsonwebtoken) - Updates lodash from 4.17.21 to 4.17.23 (via jsonwebtoken) - Resolves HIGH severity CVE-2025-65945 (CVSS 7.5) - jws HMAC signature bypass - Resolves MEDIUM severity CVE-2025-13465 (CVSS 6.9) - lodash prototype pollution

.github/workflows/publish.npm.storage.oracle.kms.yml

+    runs-on: ubuntu-latest
+    steps:
+      - name: Get the source code
+        uses: actions/checkout@v3
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20'
+
+      - name: Install package dependencies
+        run: npm install
+        working-directory: ./sdk/javascript/packages/oracle
+
+      - name: Install Syft
+        run: |
+          echo "Installing Syft v1.18.1..."
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /tmp/bin v1.18.1
+          echo "/tmp/bin" >> $GITHUB_PATH
+
+      - name: Install Manifest CLI
+        run: |
+          echo "Installing Manifest CLI v0.18.3..."
+          curl -sSfL https://raw.githubusercontent.com/manifest-cyber/cli/main/install.sh | sh -s -- -b /tmp/bin v0.18.3
+
+      - name: Create Syft configuration
+        run: |
+          cat > syft-config.yaml << 'EOF'
+          package:
+            search:
+              scope: all-layers
+            cataloger:
+              enabled: true
+              java:
+                enabled: false
+              python:
+                enabled: false
+              nodejs:
+                enabled: true
+          EOF
+
+      - name: Generate and upload SBOM
+        env:
+          MANIFEST_API_KEY: ${{ secrets.MANIFEST_TOKEN }}
+        run: |
+          JAVASCRIPT_SDK_DIR="./sdk/javascript"
+
+          # Get version from package.json
+          echo "Detecting Oracle Storage version..."
+          if [ -f "${JAVASCRIPT_SDK_DIR}/packages/oracle/package.json" ]; then
+            VERSION=$(grep -o '"version": "[^"]*"' "${JAVASCRIPT_SDK_DIR}/packages/oracle/package.json" | cut -d'"' -f4)
+            echo "Detected version: ${VERSION}"
+          else
+            VERSION="1.0.0"
+            echo "Could not detect version, using default: ${VERSION}"
+          fi
+
+          echo "Generating SBOM with Manifest CLI..."
+          /tmp/bin/manifest sbom "${JAVASCRIPT_SDK_DIR}/packages/oracle" \
+            --generator=syft \
+            --name=keeper-secrets-manager-javascript-storage-oracle-kms \
+            --version=${VERSION} \
+            --output=spdx-json \
+            --file=oracle-storage-sbom.json \
+            --api-key=${MANIFEST_API_KEY} \
+            --publish=true \
+            --asset-label=application,sbom-generated,nodejs,oracle-storage \
+            --generator-config=syft-config.yaml
+
+          echo "SBOM generated and uploaded successfully: oracle-storage-sbom.json"
+          echo "---------- SBOM Preview (first 20 lines) ----------"
+          head -n 20 oracle-storage-sbom.json
+
+  publish-npm:


In general, fix this by adding an explicit permissions: block to the workflow (either at the top level or per job) that grants the minimal required scopes, so the GITHUB_TOKEN cannot perform unintended write operations.

For this workflow, there is no evidence that any step needs write access to the repository or other GitHub resources. actions/checkout works with contents: read. None of the steps create or modify issues, pull requests, or releases. Therefore, the best minimal, non‑breaking change is to add a root‑level permissions: block directly under name:/on: that applies to both generate-sbom and publish-npm, setting contents: read. This documents intent and ensures the token remains read‑only even if repo defaults change. No imports or additional methods are needed.

Concretely, edit .github/workflows/publish.npm.storage.oracle.kms.yml to insert:

permissions: contents: read

after the on: block (or directly after name: if you prefer), keeping indentation consistent.

Fixes GHSA-7h2j-956f-4vf2 (CVE-2026-25547) DoS vulnerability

Adds existsSync and readFileSync mocks to fix Oracle SDK configuration loading

satish-metron and others added 7 commits November 21, 2025 12:23

Update Oracle KMS integration to v1.0.0 and remove package-level work…

c4f7c22

…flows

Add npm publish workflow

3d5030b

Add unit tests and test workflow

71a68ff

Track package-lock.json for npm caching

042f223

Prepare package for npm publish

81b8491

Update core dependency to 17.3.0

7a5d934

github-advanced-security bot found potential problems Nov 21, 2025

View reviewed changes

stas-schaller marked this pull request as ready for review November 24, 2025 21:28

Temp: add push trigger for workflow registration

dc94b47

stas-schaller had a problem deploying to prod November 24, 2025 21:33 — with GitHub Actions Error

stas-schaller added 2 commits November 24, 2025 16:41

Revert: remove temp push trigger

8af19ee

fix: upgrade pino to v10 to resolve CVE-2025-57319 (fast-redact vulne…

cb8dfad

…rability)

stas-schaller had a problem deploying to prod November 24, 2025 22:12 — with GitHub Actions Error

stas-schaller added 2 commits November 25, 2025 11:33

Update SBOM name to include 'javascript' for SDK identification

300945a

feat: add build-only option to publish workflow

6c268eb

github-advanced-security bot found potential problems Nov 26, 2025

View reviewed changes

stas-schaller added 3 commits December 16, 2025 14:09

fix(oracle): add publishConfig and fix repository format for npm publish

0fa5bb7

fix: install node_modules before SBOM generation

1c66340

github-advanced-security bot found potential problems Jan 27, 2026

View reviewed changes

stas-schaller added 2 commits February 4, 2026 16:50

fix: update @isaacs/brace-expansion to 5.0.1

489aa4e

Fixes GHSA-7h2j-956f-4vf2 (CVE-2026-25547) DoS vulnerability

fix: add missing fs mock methods for Oracle SDK compatibility

4b5b8eb

Adds existsSync and readFileSync mocks to fix Oracle SDK configuration loading

@@ -8,6 +8,9 @@
                     default: true
                     type: boolean
+            permissions:
+              contents: read
             jobs:
               generate-sbom:
                 runs-on: ubuntu-latest

@@ -8,6 +8,9 @@
                     default: true
                     type: boolean
+            permissions:
+              contents: read
             jobs:
               generate-sbom:
                 runs-on: ubuntu-latest

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release JavaScript Oracle KMS Storage v1.0.0#873

Release JavaScript Oracle KMS Storage v1.0.0#873
stas-schaller wants to merge 17 commits intomasterfrom
release/storage/javascript/oracle-kms/v1.0.0

stas-schaller commented Nov 21, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

socket-security bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

stas-schaller commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

socket-security bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stas-schaller commented Nov 21, 2025 •

edited

Loading

socket-security bot commented Nov 21, 2025 •

edited

Loading