build(deps): add security resolutions for vulnerable npm packages#1740
build(deps): add security resolutions for vulnerable npm packages#1740
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Code Review✅ No critical issues found. The security resolutions are properly configured and the dependency updates look safe: Minor observation:
The yarn.lock shows glob was updated to 10.5.0, but without an explicit resolution it may not be enforced across all transitive dependencies. All other resolutions (tar, axios, fast-xml-parser, systeminformation) are correctly added and applied. ✅ |
E2E Test Results✅ All tests passed • 65 passed • 4 skipped • 797s
Tests ran across 4 shards in parallel. |
Add yarn resolutions to address high and medium severity vulnerabilities in transitive dependencies: - tar: ^7.4.4 (fixes 3 high severity CVEs) - axios: ^1.7.0 (fixes 3 high severity CVEs - SSRF, redirect issues) - fast-xml-parser: ^4.4.0 (fixes 1 high - prototype pollution) - systeminformation: ^5.24.0 (fixes 1 high - command injection) - glob: ^10.4.6 (fixes 1 high - ReDoS) These resolutions force secure versions of packages that are pulled in as transitive dependencies, reducing Docker Scout vulnerability count by ~6 vulnerabilities. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
motsc
force-pushed
the
fix/npm-security-resolutions
branch
from
d49b1e5 to
f99d299
Compare
1 participant
Summary
Adds Yarn resolutions to force secure versions of vulnerable transitive dependencies, reducing Docker Scout vulnerability count.
Changes
Added resolutions for 5 packages with known security vulnerabilities:
^7.4.4- Fixes 3 High severity CVEs in tar@7.4.3^1.7.0- Fixes 3 High severity CVEs (SSRF, redirect issues) in axios@0.21.4^4.4.0- Fixes 1 High severity CVE (prototype pollution)^5.24.0- Fixes 1 High severity CVE (command injection)^10.4.6- Fixes 1 High severity CVE (ReDoS)Impact
Verification
Verified in
yarn.lock:All packages build and install successfully.
Test Plan
yarn installcompletes without errorsRelated
Follow-up to #1731 which addressed base image vulnerabilities (Node, Go, ClickHouse). This PR addresses NPM package vulnerabilities.