Skip to content

Security: Update transitive dependency resolutions#46

Open
github-actions[bot] wants to merge 1 commit intomainfrom
automated/security-resolutions
Open

Security: Update transitive dependency resolutions#46
github-actions[bot] wants to merge 1 commit intomainfrom
automated/security-resolutions

Conversation

@github-actions
Copy link
Copy Markdown

Summary

Automated update of resolutions in package.json to fix vulnerable transitive dependencies.
Sources: Dependabot alerts (medium/high/critical) + yarn audit.

Changes

Dependency Before After Severity Source
brace-expansion ^2.0.2 ^2.0.3 moderate yarn-audit
node-forge ^1.3.2 ^1.4.0 high yarn-audit
path-to-regexp ^0.1.12 ^0.1.13 high yarn-audit
picomatch (none) ^4.0.4 moderate yarn-audit
serialize-javascript ^7.0.3 ^7.0.5 moderate yarn-audit
yaml (none) ^1.10.3 moderate yarn-audit

Note: This only updates transitive dependencies via resolutions. Direct dependency upgrades should be done manually to avoid breaking changes.

Verify

  • yarn install succeeds
  • yarn build succeeds
  • App runs correctly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant