fix(deps): vuln minor upgrades — 12 packages (minor: 6 · patch: 6) [package.json] - #1384
Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates Yarn dependency constraints/lockfile with the goal of addressing reported critical/high severity vulnerabilities by upgrading several transitive packages.
Changes:
- Updated multiple
resolutionsentries inpackage.json(some moved from pinned versions to ranges) and added new overrides forjs-yaml,glob,sigstore, andpacote. - Updated
yarn.lockto reflect some dependency upgrades (e.g.,axios,tar,shell-quote,tmp) and newly introduced transitive entries (e.g.,https-proxy-agent@5).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| package.json | Updates/adds Yarn resolutions intended to force patched dependency versions. |
| yarn.lock | Lockfile regeneration reflecting some (but not all) intended upgrades and new transitive dependencies. |
Suppressed comments (1)
package.json:113
- Using an open-ended
>=range inresolutionscan cause non-deterministic installs (and for 0.x packages, minor bumps can be breaking). Since this is meant to be a security override, it’s safer to pintmpto the exact patched version.
"tmp": ">=0.2.7",
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+92
to
+93
| "fast-xml-parser": "^4.5.7", | ||
| "axios": "^1.20.0", |
Comment on lines
+134
to
+140
| "js-yaml@npm:4.1.1": "npm:^4.3.2", | ||
| "js-yaml@npm:^4.1.0": "npm:^4.3.2", | ||
| "js-yaml@npm:^3.10.0": "npm:^3.15.2", | ||
| "js-yaml@npm:^3.13.1": "npm:^3.15.2", | ||
| "glob@npm:^11.0.3": "npm:^11.1.0", | ||
| "sigstore@npm:^4.0.0": "npm:^4.1.1", | ||
| "pacote@npm:21.0.1": "npm:^21.5.1" |
…e.json] Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
Contributor
Author
Auto-rebase completeBranch is up to date with Auto-Rebase · Add |
dd-octo-sts-c33ac5
Bot
force-pushed
the
engraver-auto-version-upgrade/minorpatch/npm/0-1788160204
branch
from
August 31, 2026 19:46
f31550a to
688c2a7
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
package.json:113
- The
tmpresolution was changed to>=0.2.7, which makes installs non-deterministic and could pull in future (potentially breaking) major/minor versions. Since this is a security pin, prefer an explicit version (or at least a constrained range like^0.2.7).
"tmp": ">=0.2.7",
package.json:140
- These resolutions also don’t appear to be applied:
yarn.lockstill pinsglob@11.0.3(yarn.lock:10207-10221),sigstore@4.0.0(yarn.lock:16858-16870), andpacote@21.0.1(yarn.lock:14683-14708). If the goal is to remediate the listed vulnerabilities, the resolutions should force the fixed versions and the lockfile should be regenerated so those versions are actually selected.
"glob@npm:^11.0.3": "npm:^11.1.0",
"sigstore@npm:^4.0.0": "npm:^4.1.1",
"pacote@npm:21.0.1": "npm:^21.5.1"
Comment on lines
+134
to
+137
| "js-yaml@npm:4.1.1": "npm:^4.3.2", | ||
| "js-yaml@npm:^4.1.0": "npm:^4.3.2", | ||
| "js-yaml@npm:^3.10.0": "npm:^3.15.2", | ||
| "js-yaml@npm:^3.13.1": "npm:^3.15.2", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)
Manifests changed:
package.json(yarn)✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.
Updates
Security Details
🚨 Critical & High Severity (50 fixed)
parse()(CWE-407)certificateOIDsverification constraints are silently dropped and never enforcedcertificateOIDsverification constraints are silently dropped and never enforcedℹ️ Other Vulnerabilities (28)
maxBodyLengthReadableStreamuploads bypassmaxBodyLengthReview Checklist
Standard review:
Update Mode: all_vulns
🤖 Generated by DataDog Automated Dependency Management System