Skip to content

Commit 65e36ee

Browse files
AlexaXsAlexaXs
committed
fix: add npm overrides to resolve remaining high-severity vulnerabilities
Adds overrides in package.json for transitive dependencies that cannot be updated within their parent packages declared semver ranges: - mocha > diff: ^7.0.0 overridden to ^8.0.3 Fixes DoS in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx) - mocha > serialize-javascript: ^6.0.2 overridden to ^7.0.4 Fixes RCE via RegExp.flags and Date.prototype.toISOString (GHSA-5c6j-r48x-rmvq) - jshint > minimatch: ~3.0.2 overridden to 3.1.5 Fixes multiple ReDoS vulnerabilities (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74) Remaining: aws-sdk v2 low-severity advisory (GHSA-j965-2qgj-vjmq) affects all of v2, requires migration to v3 which is out of scope. Lint (jshint) verified passing after minimatch override.
1 parent 9436ddc commit 65e36ee

2 files changed

Lines changed: 32 additions & 47 deletions

File tree

‎package-lock.json‎

Lines changed: 23 additions & 47 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,15 @@
4747
"node-gyp": "^11.2.0",
4848
"tar-fs": "^3.0.9"
4949
},
50+
"overrides": {
51+
"mocha": {
52+
"diff": "^8.0.3",
53+
"serialize-javascript": "^7.0.4"
54+
},
55+
"jshint": {
56+
"minimatch": "3.1.5"
57+
}
58+
},
5059
"devDependencies": {
5160
"aws-sdk": "^2.1095.0",
5261
"clean-for-publish": "~1.0.2",

0 commit comments

Comments
 (0)