Skip to content

build: npm updates in order to fix vulnerabilities found in npm audit#1490

Merged
MykolaGolubyev merged 2 commits intotestingisdocumenting:masterfrom
antoinell:npm-updates
Apr 5, 2026
Merged

build: npm updates in order to fix vulnerabilities found in npm audit#1490
MykolaGolubyev merged 2 commits intotestingisdocumenting:masterfrom
antoinell:npm-updates

Conversation

@antoinell
Copy link
Copy Markdown
Contributor

This pull request addresses 5 high-severity security vulnerabilities identified in the project's npm dependencies:

High Severity Vulnerabilities (5 packages)

  1. flatted (≤3.4.1) - Unbounded recursion DoS and Prototype Pollution vulnerabilities
  2. lodash-es (≤4.17.23) - Code Injection via template imports and Prototype Pollution via array path bypass
  3. minimatch (≤3.1.3 || 9.0.0-9.0.6) - Multiple ReDoS vulnerabilities via wildcards and extglobs
  4. picomatch (4.0.0-4.0.3) - Method Injection in POSIX Character Classes and ReDoS vulnerability
  5. seroval (≤1.4.0) - Remote Code Execution, Prototype Pollution, and multiple DoS vulnerabilities

Impact

  • Total vulnerabilities: 16 (12 high, 4 moderate)
  • Attack vectors: Remote Code Execution, Denial of Service, Prototype Pollution, Code Injection
  • Affected components: Mermaid diagram rendering (via lodash-es dependency chain), ESLint configuration, and build tooling

Resolution

Package overrides have been implemented to enforce secure versions of all vulnerable dependencies while maintaining compatibility with existing functionality.

npm_audit_output.txt

@MykolaGolubyev MykolaGolubyev changed the title Npm updates in order to fix vulnerabilities found in npm audit build: npm updates in order to fix vulnerabilities found in npm audit Apr 5, 2026
@MykolaGolubyev MykolaGolubyev merged commit 6d72ca6 into testingisdocumenting:master Apr 5, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants