Skip to content

Add package overrides and bump transitive dependency versions to address vulnerabilities#7

Open
WPISabaGanji wants to merge 2 commits into
devfrom
codex/fix-github-security-alerts-in-dependencies-5w2uxh
Open

Add package overrides and bump transitive dependency versions to address vulnerabilities#7
WPISabaGanji wants to merge 2 commits into
devfrom
codex/fix-github-security-alerts-in-dependencies-5w2uxh

Conversation

@WPISabaGanji

Copy link
Copy Markdown
Contributor

Motivation

  • Pin and override transitive dependency versions to ensure consistent, upgraded packages for the development environment and to address known vulnerabilities observed in the lockfile.
  • Ensure webpack-dev-server and several transitive deps use specific, compatible versions to avoid runtime issues on newer Node versions.

Description

  • Added an overrides section to package.json and corresponding entries in package-lock.json to pin versions for webpack-dev-server and many transitive dependencies, including open, p-retry, rimraf, webpack-dev-middleware, and ws under the webpack-dev-server scope.
  • Upgraded or pinned multiple packages in the lockfile such as brace-expansion -> 2.0.2, on-headers -> 1.1.0, shell-quote -> 1.8.4, node-forge -> 1.3.3, minimatch -> 3.1.4, picomatch -> 2.3.2, lodash -> 4.17.23, serialize-javascript -> 7.0.4, svgo -> 3.3.3, fast-uri -> 3.1.2, @babel/plugin-transform-modules-systemjs -> 7.29.4, js-yaml -> 4.1.1, and webpack-dev-server -> 5.2.1 among others.
  • Also pinned nested npm package sub-dependencies (glob, minimatch, tar) and set js-yaml overrides for several Docusaurus packages (@docusaurus/utils, @docusaurus/utils-validation, @docusaurus/plugin-content-docs) and cosmiconfig.

Testing

  • Ran npm install to regenerate the lockfile and verify dependency resolution, which completed successfully.
  • Ran npm audit to validate that the updated/pinned versions addressed reported issues, and it reported improved results after the updates.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant