Skip to content

fix: Dependabot 보안 취약점을 overrides로 해결합니다#867

Merged
jk-kim0 merged 1 commit intomainfrom
fix/security-dependency-overrides
Mar 3, 2026
Merged

fix: Dependabot 보안 취약점을 overrides로 해결합니다#867
jk-kim0 merged 1 commit intomainfrom
fix/security-dependency-overrides

Conversation

@jk-kim0
Copy link
Copy Markdown
Contributor

@jk-kim0 jk-kim0 commented Mar 3, 2026

Summary

  • Dependabot 보안 알림 13건 중 실제 설치된 패키지 대상 취약점을 npm overrides로 해결합니다.
  • npm audit 결과 0 vulnerabilities 달성, 테스트 37건 전체 통과를 확인합니다.

Changes

패키지 Override 이전 → 이후 심각도
fast-xml-parser ^5.3.4^5.3.6 5.3.4 → 5.4.2 critical/high
rollup 신규 ^4.59.0 4.53.3 → 4.59.0 high
minimatch@3 신규 ^3.1.3 3.1.2 → 3.1.5 high
minimatch@5 신규 ^5.1.8 5.1.6 → 5.1.9 high
minimatch@9 신규 ^9.0.7 9.0.5 → 9.0.9 high
minimatch@10 신규 ^10.2.3 10.0.3 → 10.2.4 high
ajv 신규 ^6.14.0 6.12.6 → 6.14.0 moderate

해당 없음 (미설치): basic-ftp (#44), hono (#36), qs (#33)

Added/updated tests?

  • No, and this is why: 보안 패치를 위한 의존성 버전 override만 변경하였으며, 기존 테스트 37건 전체 통과를 확인하였습니다.

🤖 Generated with Claude Code

- fast-xml-parser ^5.3.4 → ^5.3.6 (critical: entity encoding bypass, high: DoS entity expansion)
- rollup ^4.59.0 추가 (high: arbitrary file write via path traversal)
- minimatch@3 ^3.1.3 추가 (high: ReDoS matchOne backtracking)
- minimatch@5 ^5.1.8 추가 (high: ReDoS matchOne/extglobs)
- minimatch@9 ^9.0.7 추가 (high: ReDoS matchOne backtracking)
- minimatch@10 ^10.2.3 추가 (high: ReDoS matchOne/extglobs)
- ajv ^6.14.0 추가 (moderate: ReDoS $data option)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 3, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
querypie-docs Ready Ready Preview, Comment Mar 3, 2026 7:59am

Request Review

@jk-kim0 jk-kim0 self-assigned this Mar 3, 2026
@jk-kim0 jk-kim0 merged commit 0a7c6fe into main Mar 3, 2026
5 checks passed
@jk-kim0 jk-kim0 deleted the fix/security-dependency-overrides branch March 3, 2026 08:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant