Skip to content

fix: resolve dev-dependency audit vulnerabilities#696

Closed
douglance wants to merge 1 commit intomainfrom
dl/audit
Closed

fix: resolve dev-dependency audit vulnerabilities#696
douglance wants to merge 1 commit intomainfrom
dl/audit

Conversation

@douglance
Copy link
Copy Markdown
Contributor

Summary

  • Adds pnpm overrides to resolve 9 transitive vulnerabilities in dev tooling
  • All advisories are in dev-only dependencies (vitest, eslint, typescript-eslint, @wagmi/cli, ts-morph, patch-package) — none affect production runtime
Override Version Advisories Fixed
vite 7.3.2 GHSA-4w7w-66w2-5vf9 (high), GHSA-p9ff-h696-f583 (high), GHSA-v2wj-q39q-566r (moderate)
flatted >=3.4.2 GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
picomatch >=2.3.2 GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
brace-expansion 5.0.5 GHSA-f886-m6hf-6m8v
yaml >=2.8.3 GHSA-48c2-rrv3-qjmp

Test plan

  • npm run audit:ci passes
  • tsc --noEmit passes
  • All 193 unit tests pass

Add overrides for vite, flatted, picomatch, brace-expansion, and yaml
to resolve transitive vulnerabilities in dev tooling (vitest, eslint,
typescript-eslint, @wagmi/cli, ts-morph, patch-package).
@douglance douglance closed this Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant