Security enhancements - #200
Merged
Merged
Conversation
Add overrides clearing six high-severity advisories that were failing the security-audit gate on v1: brace-expansion, browserslist, fast-uri, form-data, ip-address, and js-yaml. All are transitive, and each is pinned to a patched release within its existing major. Four of these (brace-expansion, form-data, ip-address, js-yaml) were present in the production tree, so this reduces the prod exposure of the v1 line as well as greening CI. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the six high-severity advisories that were failing the security-audit gate on the
v1branch.npm run auditnow passes; 0 high remain innpm audit --omit=dev.Ships to consumers
Nothing in this PR — every fix is an
overridespin, and consumers don't inherit overrides. Verified what a fresh consumer install of this package resolves through our published ranges:^1.1.7^2.5.5^10.1.14.2.0(exact pin)The first three were stale-lockfile-only: consumers already resolve patched versions; the overrides bring this repo's lockfile/CI in line. The overrides are not what protects consumers — the ranges already do.
Lockfile only (dev deps)
browserslist → ^4.28.8 (GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g); fast-uri → ^3.1.5.
Notes for the reviewer
brighterscript@1.0.0-alpha.52still lists in productiondependencies. This is already fixed on the brighterscript v1 branch (the master merge brought in chore: remove dead production dependencies brighterscript#1735's prod-dep cleanup) but no alpha has been published since — publishing1.0.0-alpha.53resolves it for all consumers; this repo then picks it up on its next lockfile refresh (^1.0.0-alpha.52already covers it).qs,uuid) are also consumer-inherited but unfixable at this level: postman-request pinsqs ~6.14.1/uuid ^8.3.2, so no safe resolution exists without upstream releases. Below the high gate floor; deferred.Verification
npm run preversionpasses (build, lint, 129 tests at 96% statement coverage);npm run auditexits clean.🤖 Generated with Claude Code