Add dependency overrides to resolve security vulnerabilities#2200
Add dependency overrides to resolve security vulnerabilities#2200IsmaelMartinez merged 3 commits intomainfrom
Conversation
…n docs-site Add npm overrides to docs-site/package.json to fix three Dependabot alerts: - minimatch ReDoS (High, #58): override to >=10.2.1 - lodash-es Prototype Pollution (Moderate, #47): resolved via updated mermaid pulling lodash-es 4.17.23 - ajv ReDoS (Moderate, #57): override schema-utils to ^4.0.0 in file-loader, url-loader, and null-loader to use ajv 8.18.0 npm audit now reports 0 vulnerabilities. Docs-site build verified. https://claude.ai/code/session_01EhHyBQRnZde6WRs2o6S1eZ
Summary of ChangesHello @IsmaelMartinez, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the security posture of the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
✅ Changelog entry generated and committed to this PR: The file You can edit it directly in this PR if needed. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds dependency overrides to resolve security vulnerabilities, which is a good practice. I've suggested a simplification to the overrides configuration in package.json to make it more concise and robust for future dependency updates.
Address review feedback: replace per-loader schema-utils overrides with a single global override since all other consumers already use ^4.0.0. https://claude.ai/code/session_01EhHyBQRnZde6WRs2o6S1eZ
|
📦 PR Snap Build Artifacts✅ Snap builds successful! Download artifacts: 🐧 Linux Snap Packagesx86_64 (107.67 MB) arm64 (104.58 MB) armv7l (98.81 MB) 📝 Note: Other package formats (.deb, .rpm, .AppImage, .dmg, .exe) are built in the main workflow |
📦 PR Build Artifacts✅ Build successful! Download artifacts: 🐧 Linuxx86_64 (435.54 MB) - Contains: .deb, .rpm, .tar.gz, .AppImage arm64 (426.73 MB) - Contains: .deb, .rpm, .tar.gz, .AppImage armv7l (404.81 MB) - Contains: .deb, .rpm, .tar.gz, .AppImage 🍎 macOSx86_64 (125.26 MB) - Contains: .dmg 🪟 Windowsx86_64 (105.72 MB) - Contains: .exe installer 📝 Note: Snap packages (.snap) are built in a separate workflow 🕐 Last updated: 2026-02-19 23:06 UTC |
2 participants
Summary
Added npm dependency overrides to the docs-site package to enforce specific versions of transitive dependencies and resolve security vulnerabilities.
Key Changes
overridesconfiguration to package.json to enforce minimum versions of vulnerable dependenciesminimatchto version >=10.2.1 to address security issuesschema-utilsversion ^4.0.0 forfile-loader,url-loader, andnull-loaderto ensure compatible and secure versions of their dependenciesDetails
The overrides configuration ensures that regardless of what versions these loaders request, they will use the specified versions of
schema-utils. This approach prevents dependency conflicts while maintaining security standards without requiring updates to the loader packages themselves.https://claude.ai/code/session_01EhHyBQRnZde6WRs2o6S1eZ