Resolved fixable npm audit vulnerabilities#338
Merged
som-sewardr1 merged 6 commits intomasterfrom Feb 23, 2026
Merged
Conversation
- Upgraded axios 0.21.4 -> 1.13.5 (fixes SSRF/credential leakage) - Upgraded cypress 12.17.4 -> 15.10.0 (fixes critical @cypress/request SSRF) - Upgraded wait-on 3.3.0 -> 9.0.4 (fixes tough-cookie prototype pollution) - Removed unused lodash.template (command injection, no upstream fix) - Removed unused faker 6.6.6 (malicious/corrupted package) - Applied npm audit fix: @babel/helpers, @babel/runtime, node-forge, on-headers, prismjs, qs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The lockfile was previously generated with Node 24 / npm 11, causing npm ci to fail in GitHub Actions which runs Node 20. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cypress 13+ requires explicit file extensions in cy.intercept() fixture references. Cypress 12 auto-resolved missing extensions; the newer versions do not, causing execOptions.factory.call is not a function errors across all e2e specs. Added .json extension to 11 fixture paths in search_page.js and 2 fixture paths in details_page.js. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three related issues after upgrading from Cypress 12 to 15:
1. cypress/support/component.ts imported { mount } from 'cypress/react',
which in Cypress 15 requires react-dom/client (React 18 API). This
project uses React 16, causing the import to throw at startup and
corrupting the Cypress command registry — the root cause of the
"execOptions.factory.call is not a function" errors across all e2e specs.
2. cypress.config.ts declared a component devServer with bundler: "webpack",
but @cypress/webpack-dev-server is not installed. Removed the component
config block to prevent Cypress from attempting to resolve it.
3. cypress/plugins/index.js did not return config, which is required by
Cypress 13+ setupNodeEvents.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Axios 1.x ships its library as ESM modules (import/export syntax). When
webpack 5's ProvidePlugin tries to inject require('process/browser') into
these ESM files during bundling, the resolution fails in webpack 5's ESM
module context. The result is a broken module factory in the browser bundle
which throws "TypeError: execOptions.factory.call is not a function" as an
uncaught exception during every Cypress test visit.
Root cause traced to: webpack/lib/javascript/JavascriptModulesPlugin.js
where __webpack_modules__[moduleId] was not a function for the axios module.
Fix: alias 'axios' to its pre-built browser CJS bundle
(axios/dist/browser/axios.cjs) which already handles process/browser
internally and produces no ESM/CJS resolution conflicts with webpack 5.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
som-sewardr1
requested review from
ian-j-abbott-accenture and
som-sewardr1
and removed request for
ian-j-abbott-accenture
Contributor
|
Let's close these CVEs. |
Contributor
|
Merging to squash CVEs. |
som-sewardr1
approved these changes
Feb 23, 2026
Contributor
som-sewardr1
left a comment
som-sewardr1
left a comment
There was a problem hiding this comment.
Clean CVE resolution.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reduced vulnerabilities from 83 → 57; upgraded axios, cypress, wait-on; removed unused faker and lodash.template; applied non-breaking audit fixes.
Description
Reminders
package.jsonso that releases to npm aremade without version conflict?
npm installto update the version number in thepackage.lock?