Heroku CLI Security Vulnerabilities

[Dipjoy098]

What is the current behavior?
I am using the latest Heroku CLI (heroku/11.0.2 darwin-arm64 node-v24.15.0), which we have baked into our Docker image; however, it is introducing certain vulnerabilities. Below are the details of the affected packages.

Package names with Severity

P0

pkg:npm/plist@3.0.6

P1

npm:glob@10.5.0
npm:diff@7.0.0
npm:diff@4.0.1
npm:qs@6.14.0
npm:fast-uri@3.1.0
npm:minimatch@3.1.2
npm:path-to-regexp@8.2.0
npm:ajv@8.17.1

P2

npm:picomatch@2.3.1
npm:lodash@4.17.21
npm:async@3.2.4
npm:tmp@0.0.33
npm:async@2.6.4
npm:async@3.2.4
npm:brace-expansion@1.1.11
What is the expected behavior?
Can you please remediate the security vulnerabilities in CLI?

[michaelmalave]

Hi there @Dipjoy098 thanks for raising this issue. I notice you're currently using version 11.0.2. You can make sure you have the latest version which can contain resolutions to these vulnerabilities and is, as of a April 15, 11.3.0. You can run heroku update to get the latest version.
Its also worth knowing that the CLI's dependabot alerts https://github.com/heroku/cli/security/dependabot are remediated in a timely manner and updating to the latest version will ensure you get those fixes.