Dependabot was switched on today and immediately reported seven critical advisories. Four of them are closed here.
| Package | What it was | Fixed in |
|---|---|---|
protobufjs |
Arbitrary code execution | 7.6.5 |
handlebars |
JavaScript injection via AST type confusion | 4.7.9 |
shell-quote |
quote() failing to escape newlines |
1.10.0 |
vitest |
Arbitrary file read and execute while the UI server listens | 3.2.6 |
Three of the four arrive through other packages, so version pins are what actually close them — bumping a direct dependency leaves the older copies in place.
24 findings closed. 181 remain, down from 264 this morning.
The three criticals still open both need major upgrades: tar 7.x, which arrives through bcrypt's build tooling, and happy-dom 20.x. Each is a change with its own risk and will be taken on its own rather than swept through. The full list, with a reason per entry, is in .github/osv-known.txt.
Verified by booting the container image on the production host before deploying it.
Full diff: v3.4.1...v3.4.2