fix(deps): [Snyk] Fix for 9 vulnerabilities by mttrbrts · Pull Request #545 · accordproject/template-playground

mttrbrts · 2026-01-12T09:45:56Z

Snyk has created this PR to fix 9 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json
package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	External Control of File Name or Path SNYK-JS-JSPDF-14873131	****
	Open Redirect SNYK-JS-REACTROUTER-14908286	****
	Infinite loop SNYK-JS-MARKDOWNIT-6483324	696
	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	676
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-12613773	666
	Directory Traversal SNYK-JS-MAMMOTH-13554470	641
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9292519	631
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857	586
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9403194	524

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Cross-site Request Forgery (CSRF)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSPDF-14873131 - https://snyk.io/vuln/SNYK-JS-REACTROUTER-14908286 - https://snyk.io/vuln/SNYK-JS-MARKDOWNIT-6483324 - https://snyk.io/vuln/SNYK-JS-AXIOS-6032459 - https://snyk.io/vuln/SNYK-JS-AXIOS-12613773 - https://snyk.io/vuln/SNYK-JS-MAMMOTH-13554470 - https://snyk.io/vuln/SNYK-JS-AXIOS-9292519 - https://snyk.io/vuln/SNYK-JS-AXIOS-6124857 - https://snyk.io/vuln/SNYK-JS-AXIOS-9403194

netlify · 2026-01-12T09:46:03Z

✅ Deploy Preview for ap-template-playground ready!

Name	Link
🔨 Latest commit	`cafe7bf`
🔍 Latest deploy log	https://app.netlify.com/projects/ap-template-playground/deploys/69a02d96ce98a5000854c03f
😎 Deploy Preview	https://deploy-preview-545--ap-template-playground.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-02-15T02:20:53Z

This PR is stale because it has been open 15 days with no activity. Remove stale label or comment or this will be closed in 10 days.

Copilot

Pull request overview

This is an automated Snyk security fix PR that updates npm dependencies to address 9 reported vulnerabilities ranging from critical to medium severity. The PR claims to fix vulnerabilities in axios, react-router, markdown-it, jspdf, and mammoth packages through dependency upgrades. However, the actual code changes only update Accord Project core dependencies and react-router-dom.

Changes:

Updated 5 Accord Project dependencies (@accordproject/concerto-core, markdown-common, markdown-template, markdown-transform, template-engine) to newer minor/patch versions
Updated react-router-dom from 6.24.1 to 6.30.2 to address Open Redirect vulnerability

Copilot · 2026-02-26T09:26:48Z

package.json

+    "@accordproject/concerto-core": "^3.15.0",
+    "@accordproject/markdown-common": "^0.16.23",
+    "@accordproject/markdown-template": "^0.16.23",
+    "@accordproject/markdown-transform": "^0.16.21",
+    "@accordproject/template-engine": "^2.6.5",


The PR description claims to fix vulnerabilities in html2pdf.js (upgrading 0.12.1 to 0.13.0), jspdf, mammoth, and markdown-it. However, the package.json diff only shows updates to @accordproject dependencies and react-router-dom. The html2pdf.js version remains at 0.14.0 (not 0.12.1 as mentioned), and jspdf/mammoth are not direct dependencies. This discrepancy suggests either the PR description is incorrect, the changes are incomplete, or these vulnerabilities are being fixed through transitive dependency updates in package-lock.json. Please verify that all mentioned vulnerabilities are actually being addressed by these changes.

Copilot · 2026-02-26T09:26:49Z

package.json

@@ -49,7 +49,7 @@
    "react-icons": "^5.5.0",
    "react-markdown": "^9.0.1",
    "react-resizable-panels": "^3.0.3",
-    "react-router-dom": "^6.24.1",
+    "react-router-dom": "^6.30.2",


This PR must include Developer Certificate of Origin (DCO) sign-off on all commits as required by the project. According to the Accord Project commit conventions, every commit must be signed using 'git commit --signoff'. Additionally, the commit message should follow the format 'type(scope): description' (e.g., 'chore(deps): fix for 9 vulnerabilities'). Since this is an automated Snyk PR, please ensure it adheres to these project requirements before merging.

Signed-off-by: mttrbrts <code@rbrts.uk>

Copilot

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

* fix: package.json & package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSPDF-14873131 - https://snyk.io/vuln/SNYK-JS-REACTROUTER-14908286 - https://snyk.io/vuln/SNYK-JS-MARKDOWNIT-6483324 - https://snyk.io/vuln/SNYK-JS-AXIOS-6032459 - https://snyk.io/vuln/SNYK-JS-AXIOS-12613773 - https://snyk.io/vuln/SNYK-JS-MAMMOTH-13554470 - https://snyk.io/vuln/SNYK-JS-AXIOS-9292519 - https://snyk.io/vuln/SNYK-JS-AXIOS-6124857 - https://snyk.io/vuln/SNYK-JS-AXIOS-9403194 * Implement feature X to enhance user experience and fix bug Y in module Z Signed-off-by: mttrbrts <code@rbrts.uk> * chore(deps): bump ap versions Signed-off-by: mttrbrts <code@rbrts.uk> --------- Signed-off-by: mttrbrts <code@rbrts.uk> Co-authored-by: snyk-bot <snyk-bot@snyk.io>

* fix: package.json & package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSPDF-14873131 - https://snyk.io/vuln/SNYK-JS-REACTROUTER-14908286 - https://snyk.io/vuln/SNYK-JS-MARKDOWNIT-6483324 - https://snyk.io/vuln/SNYK-JS-AXIOS-6032459 - https://snyk.io/vuln/SNYK-JS-AXIOS-12613773 - https://snyk.io/vuln/SNYK-JS-MAMMOTH-13554470 - https://snyk.io/vuln/SNYK-JS-AXIOS-9292519 - https://snyk.io/vuln/SNYK-JS-AXIOS-6124857 - https://snyk.io/vuln/SNYK-JS-AXIOS-9403194 * Implement feature X to enhance user experience and fix bug Y in module Z Signed-off-by: mttrbrts <code@rbrts.uk> * chore(deps): bump ap versions Signed-off-by: mttrbrts <code@rbrts.uk> --------- Signed-off-by: mttrbrts <code@rbrts.uk> Co-authored-by: snyk-bot <snyk-bot@snyk.io> Signed-off-by: hemantch01 <hemantchaudhary905@gmail.com>

mttrbrts requested a review from a team as a code owner January 12, 2026 09:45

Merge branch 'main' into snyk-fix-94156fe7057f6f97f4de12a92311c010

64f582f

github-actions bot added the Stale label Feb 15, 2026

Merge branch 'main' into snyk-fix-94156fe7057f6f97f4de12a92311c010

7953287

Copilot AI review requested due to automatic review settings February 26, 2026 09:24

Copilot started reviewing on behalf of mttrbrts February 26, 2026 09:24 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Implement feature X to enhance user experience and fix bug Y in module Z

8bdd055

Signed-off-by: mttrbrts <code@rbrts.uk>

mttrbrts changed the title ~~[Snyk] Fix for 9 vulnerabilities~~ fix(deps): [Snyk] Fix for 9 vulnerabilities Feb 26, 2026

chore(deps): bump ap versions

cafe7bf

Signed-off-by: mttrbrts <code@rbrts.uk>

Copilot AI review requested due to automatic review settings February 26, 2026 11:25

Copilot started reviewing on behalf of mttrbrts February 26, 2026 11:25 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

mttrbrts enabled auto-merge (squash) February 26, 2026 11:28

mttrbrts disabled auto-merge February 26, 2026 11:29

mttrbrts merged commit c7bdb15 into main Feb 26, 2026
12 of 13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): [Snyk] Fix for 9 vulnerabilities#545

fix(deps): [Snyk] Fix for 9 vulnerabilities#545
mttrbrts merged 5 commits intomainfrom
snyk-fix-94156fe7057f6f97f4de12a92311c010

mttrbrts commented Jan 12, 2026

Uh oh!

netlify bot commented Jan 12, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mttrbrts commented Jan 12, 2026

Snyk has created this PR to fix 9 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

netlify bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ap-template-playground ready!

Uh oh!

github-actions bot commented Feb 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Jan 12, 2026 •

edited

Loading