Skip to content

chore: fix security vulnerabilities in dependencies#1

Open
Copilot wants to merge 2 commits into
mainfrom
copilot/chore-fix-security-vulns
Open

chore: fix security vulnerabilities in dependencies#1
Copilot wants to merge 2 commits into
mainfrom
copilot/chore-fix-security-vulns

Conversation

Copy link
Copy Markdown

Copilot AI commented May 1, 2026

Removes 22 critical CVEs introduced by babel-preset-env@1.7.0 (unmaintained, depended on the vulnerable legacy babel-traverse). Also patches high/moderate transitive vulnerabilities in @babel/helpers, @babel/runtime, minimatch, picomatch, and brace-expansion.

Changes

  • Remove babel-preset-env@1.7.0 — replaced by @babel/preset-env (already present as devDep, promoted to dep since it's used at runtime in bundler.ts)
  • Upgrade @babel/* to ^7.27.0 — pulls in patched @babel/helpers and @babel/runtime (>=7.26.10)
  • Add pnpm.overrides to force patched versions of vulnerable transitive deps:
    • minimatch@3^3.1.4 (3× high ReDoS)
    • picomatch@2^2.3.2 (high ReDoS)
    • brace-expansion@1^1.1.13 (moderate/low ReDoS)
  • src/bundler.ts — explicit preset reference: "env""@babel/preset-env"

Result: pnpm audit / npm audit report 0 vulnerabilities.

Copilot AI and others added 2 commits May 1, 2026 07:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants