Skip to content

v2.9.3 Strict Dependency & Template Security Hardening

Choose a tag to compare

View all tags
@paudang paudang released this 28 Aug 12:24
· 5 commits to main since this release
v2.9.3
898c4f3

Strict Dependency & Template Security Hardening:

  • js-yaml DoS & Compatibility Fix: Pinned js-yaml to ^4.3.2 in package overrides across package.json and templates/common/package.json.ejs, fixing quadratic CPU consumption advisories (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj) while preserving full compatibility with jest@30.4.2 and preventing forced dependency downgrades.
  • brace-expansion DoS Mitigation: Updated brace-expansion override to ^5.0.9 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), eliminating exponential-time CPU loop vulnerability.
  • Daily Template Audit Hardening: Added strict overrides for body-parser (^1.20.6), ip-address (^10.5.0), shell-quote (^1.10.0), undici (^6.28.0), semver (^7.7.1), and upgraded mongoose to ^8.24.4 and snyk to ^1.1307.0 to maintain a pristine 0-vulnerability baseline in daily-audit.yml.

Full Changelog: v2.9.2...v2.9.3

Assets 2
Loading