Skip to content

Fix npm security vulnerabilities #546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix npm security vulnerabilities #546

wants to merge 1 commit into from

Conversation

aranke
Copy link
Member

@aranke aranke commented Mar 27, 2025

Summary

  • Update prismjs to >=1.30.0 to address DOM Clobbering vulnerability (Medium severity)
  • Add elliptic >=6.6.1 to fix critical security vulnerability
  • Pin braces to >=3.0.3 to fix high severity vulnerability
  • Add explicit version requirements for other dependencies with security issues

Test plan

  • Package installs correctly with npm install
  • Application builds and runs normally
  • Note: This PR fixes direct and some transitive dependencies but doesn't address all vulnerabilities that would require breaking changes

🤖 Generated with Claude Code

@aranke
Fix npm security vulnerabilities
6fb9de4 
- Update prismjs to ^1.30.0 to address DOM Clobbering vulnerability
- Add elliptic >=6.6.1 to fix critical security vulnerability
- Update braces, body-parser, and ws dependencies
- Add explicit version pins for other dependencies with security issues

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
@aranke aranke requested a review from a team as a code owner March 27, 2025 13:47
@cla-bot cla-bot bot added the cla:yes label Mar 27, 2025
@github-actions GitHub Actions
Copy link
Contributor

Thank you for your pull request! We could not find a changelog entry for this change. For details on how to document a change, see the contributing guide.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
cla:yes
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@aranke