Skip to content

v14.1.2 — vulnerability patch

Choose a tag to compare

View all tags
@maw629 maw629 released this 11 Jul 16:36
· 112 commits to main since this release
v14.1.2
6b813b0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First substantive vulnerability patch of this fork. Per-dep same-major bumps to reduce audit surface without touching lib/, bin/, doc/.

Bumps

  • minimist 1.2.6 → 1.2.8 (prototype-pollution fix, CVE-2021-44906)
  • portfinder 1.0.28 → 1.0.38
  • eol (dev) 0.9.1 → 0.10.0
  • express (dev) 4.17.1 → 4.22.2

Audit delta: 54 → 47 (-7)

  • Critical: 6 (unchanged)
  • High: 20 → 16 (-4)
  • Moderate: 20 (unchanged)
  • Low: 8 → 5 (-3)

Preserved

  • Shipped lib/, bin/, doc/ byte-identical to upstream v14.1.1.
  • engines.node stays ">=12".
  • No API surface changes.

See docs/superpowers/audits/2026-07-11-14.1.2-audit-delta.md for the full per-dep decision table and the list of deps explicitly deferred to 15.0.0.

Published under dist-tag latest — moves off 14.1.1-pkgnec.0 for the first time.

Assets 2
Loading