Skip to content

(fix):Vulnerabilities#252

Draft
sntiwari1 wants to merge 6 commits intomasterfrom
security_fix
Draft

(fix):Vulnerabilities#252
sntiwari1 wants to merge 6 commits intomasterfrom
security_fix

Conversation

@sntiwari1
Copy link
Copy Markdown
Collaborator

No description provided.

sntiwari1 and others added 5 commits April 16, 2026 13:14
…and overrides

- Add npm overrides block to force safe versions of ~60 transitive deps
  (handlebars, lodash, minimist, pbkdf2, elliptic, tar, qs, ws, etc.)
- Update direct deps: express@4.21.2, lodash@4.17.21, body-parser@1.20.3,
  jquery@3.7.1, ajv@8.17.1, grunt@1.5.3, karma@6.4.4, jsdoc@4.0.3,
  @project-sunbird/telemetry-sdk@2.0.1, grunt-contrib-connect@2.1.0,
  grunt-contrib-watch@1.1.0, grunt-aws-s3@2.0.2
- Migrate node-sass to sass (dart-sass) to fix Node 18 compatibility
- Remove deprecated request package; replace usage with native http/https
- Remove unused image-webpack-loader (was installed but never used in build)
- Remove phantomjs/karma-phantomjs-launcher (deprecated, pulls old request)
- Remove codacy-coverage (deprecated, no fix for hoek dependency chain)
- Update clean-css, html-minifier, file-loader, url-loader, zip-webpack-plugin
- Reduces npm audit from 180 vulnerabilities to 31 (0 critical, 4 high)
…ility

- Upgrade gulp ^3.9.1 → ^4.0.2 (gulp 3 throws primordials error on Node 10+)
- Rewrite gulpfile.js with gulp 4 series/parallel API
- Remove NODE_OPTIONS=--openssl-legacy-provider from CI workflows
  (webpack 5 uses native hash functions; legacy provider not needed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comment thread gulpfile.js
});
}
var plugin = fs.readFileSync('plugins/' + plugin + '/editor/plugin.min.js', 'utf8');
fs.appendFileSync('content-editor/scripts/coreplugins.js', 'org.ekstep.pluginframework.pluginManager.registerPlugin(' + JSON.stringify(manifest) + ',eval(\'' + plugin.replace(/'/g, "\\'") + '\'))' + '\n');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants