Skip to content

Fix 4 npm audit vulnerabilities in UI dependencies#214

Merged
leonvanzyl merged 2 commits intomasterfrom
fix/npm-audit-vulnerabilities
Feb 26, 2026
Merged

Fix 4 npm audit vulnerabilities in UI dependencies#214
leonvanzyl merged 2 commits intomasterfrom
fix/npm-audit-vulnerabilities

Conversation

@leonvanzyl
Copy link
Collaborator

Summary

  • Ran npm audit fix in ui/ to resolve all 4 reported vulnerabilities
  • High: rollup (arbitrary file write via path traversal), minimatch (ReDoS)
  • Moderate: ajv (ReDoS with $data option), lodash (prototype pollution in _.unset/_.omit)
  • All are dev/build dependencies — no runtime impact
  • Build verified passing with 0 vulnerabilities remaining

Test plan

  • npm audit reports 0 vulnerabilities
  • npm run build passes successfully

🤖 Generated with Claude Code

leonvanzyl and others added 2 commits February 26, 2026 14:04
Update rollup, minimatch, ajv, and lodash to patched versions
via npm audit fix (2 high, 2 moderate → 0 vulnerabilities).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@leonvanzyl leonvanzyl merged commit 7f875c3 into master Feb 26, 2026
2 checks passed
@leonvanzyl leonvanzyl deleted the fix/npm-audit-vulnerabilities branch February 26, 2026 12:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant