Skip to content

fix: resolve npm Dependabot vulnerabilities across sdks, tests, and docs#789

Merged
hittyt merged 1 commit into
alibaba:mainfrom
Pangjiping:fix/npm-dependabot-vulnerabilities
Apr 25, 2026
Merged

fix: resolve npm Dependabot vulnerabilities across sdks, tests, and docs#789
hittyt merged 1 commit into
alibaba:mainfrom
Pangjiping:fix/npm-dependabot-vulnerabilities

Conversation

@Pangjiping
Copy link
Copy Markdown
Collaborator

Summary

  • minimatch 5.1.8 — ReDoS (high)
  • rollup 4.60.2 — Arbitrary File Write (high)
  • flatted 3.4.2 — DoS + Prototype Pollution (high)
  • vite 6.4.2 — Path Traversal (moderate)
  • esbuild 0.25.2 — Dev Server Request Smuggling (moderate)
  • postcss 8.5.10 — XSS (moderate)
  • picomatch 4.0.4 — Method Injection (moderate)
  • brace-expansion 1.1.13 / 2.0.3 — Zero-step DoS (moderate)

Testing

  • Not run (explain why)
  • Unit tests
  • Integration tests
  • e2e / manual verification

Breaking Changes

  • None
  • Yes (describe impact and migration path)

Checklist

  • Linked Issue or clearly described motivation
  • Added/updated docs (if needed)
  • Added/updated tests (if needed)
  • Security impact considered
  • Backward compatibility considered

Update direct dependencies (eslint, typescript-eslint, undici, tsup,
openapi-typescript, vitest) and add pnpm.overrides for transitive
dependencies (minimatch, rollup, vite, esbuild, postcss, flatted,
picomatch, brace-expansion) to fix all open npm Dependabot alerts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@Pangjiping Pangjiping requested a review from ninan-nn as a code owner April 25, 2026 09:14
@Pangjiping Pangjiping added the bug Something isn't working label Apr 25, 2026
Copy link
Copy Markdown
Collaborator

@hittyt hittyt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hittyt hittyt merged commit 0f237dd into alibaba:main Apr 25, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working sdk/js

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants