Skip to content

Conversation

Mathiyarasy
Copy link
Contributor

@Mathiyarasy Mathiyarasy commented Jul 22, 2025

Fixes : https://github.com/github/codespaces-react/security/dependabot/42

Description:

  • form-data uses unsafe random function in form-data for choosing boundary
  • Affected versions >= 4.0.0, < 4.0.4
  • Patched version 4.04
  • Transitive dependency form-data 4.0.0 is introduced via
    jsdom 22.1.0 form-data 4.0.0
  • Existing dependabot PR for this issue updated the package-lock.json file to update form-data to patched version.
  • This may not be required as the latest jsdom package removed the form-data as its dependency

Changes:

  • Updated package vitejs/plugin-react to resolve existing peer dependency conflict in the project
    @vitejs/plugin-react@4.1.1 declares a peer dependency on vite version ^4.2.0.
    Since the latest vite version is 6.2.7 updated the vitejs/plugin-react@4.7.0
  • Updated package jsdom to latest version which do not have any dependency on form-data

@Mathiyarasy Mathiyarasy marked this pull request as ready for review July 22, 2025 09:31
@Copilot Copilot AI review requested due to automatic review settings July 22, 2025 09:31
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates two development dependencies to resolve a security vulnerability in the form-data package. The vulnerability stems from an unsafe random function used for choosing boundaries in form-data versions 4.0.0 to 4.0.3, which was transitively introduced via jsdom 22.1.0.

  • Updated @vitejs/plugin-react from 4.1.1 to 4.7.0 to resolve peer dependency conflicts with vite 6.2.7
  • Updated jsdom from 22.1.0 to 26.1.0 to eliminate the vulnerable form-data dependency

@tomggill tomggill merged commit 4ddece1 into main Jul 22, 2025
2 checks passed
@tomggill tomggill deleted the dev/Mathi/formData branch July 22, 2025 16:38
@jm809 jm809 mentioned this pull request Sep 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants