Resolve low-hanging CVE Dependabot alerts via dependency bumps (2.19) - #1
Open
angle943 wants to merge 1 commit into
Open
Resolve low-hanging CVE Dependabot alerts via dependency bumps (2.19)#1angle943 wants to merge 1 commit into
angle943 wants to merge 1 commit into
Conversation
Resolves ~26 GitHub Dependabot alerts whose patched version is reachable within the existing semver ranges, by regenerating the affected yarn.lock entries plus a few targeted resolutions / direct-dep bumps. Upgraded (all >= advisory patched version): - lodash / lodash-es -> 4.18.1 (CVE-2026-4800, CVE-2026-2950, CVE-2025-13465) - node-forge -> 1.4.0 (CVE-2026-33891/33894/33895/33896) - picomatch -> 2.3.2 (CVE-2026-33671, CVE-2026-33672) - flatted (3.x) -> 3.4.2 (CVE-2026-33228, CVE-2026-32141) - immutable -> 4.3.8 (CVE-2026-29063) - minimatch -> 3.1.5/5.1.9/9.0.9 (CVE-2026-27904/27903/26996) - dompurify -> 3.4.11 (GHSA-39q2/cjmm/cj63/h8r8, CVE-2026-0540, CVE-2025-15599) - follow-redirects -> 1.16.0 (GHSA-r4q5-vmmm-2653) - axios -> 0.31.1 / 1.18.0 (CVE-2026-40175, CVE-2025-62718) - brace-expansion -> 1.1.15/2.1.1 (CVE-2026-33750) - yaml -> 2.9.0 (CVE-2026-33532) - bn.js -> 4.12.3 / 5.2.3 (CVE-2026-2739) - ajv -> 6.15.0 / 8.20.0 (CVE-2025-69873) Targeted resolutions added (close pinned transitive instances): - **/lodash ^4.18.1, **/@microsoft/tsdoc-config/ajv ^6.14.0, **/grunt/minimatch ^3.1.4 Direct-dep bumps: - axios ^0.30.0 -> ^0.31.0 in @osd/ui-shared-deps and @osd/dev-utils Verified with `yarn install --frozen-lockfile` (lockfile consistent). Note: final `yarn osd bootstrap` + build/tests should run on a node-18 host/CI. Signed-off-by: Justin Kim <jungkm@amazon.com>
angle943
force-pushed
the
fix/cve-2.19-low-hanging-deps
branch
from
June 18, 2026 23:36
9d1dd5c to
bd73e49
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the GitHub Dependabot alerts on
2.19whose patched version is reachable within the existing semver ranges — done by regenerating the affectedyarn.lockentries, plus a few targetedresolutionsand two direct-dep bumps. ~26 alerts closed.Each alert was mapped via the GitHub Advisory DB → affected/patched ranges, cross-referenced against the actual
yarn.lock, and the patched versions confirmed published on npm.Upgraded (all ≥ advisory patched version)
Targeted
resolutionsadded**/lodash: ^4.18.1·**/@microsoft/tsdoc-config/ajv: ^6.14.0·**/grunt/minimatch: ^3.1.4(closes pinned transitive instances that the lockfile regen alone left on vulnerable versions).
Direct-dep bumps
axios ^0.30.0 → ^0.31.0in@osd/ui-shared-depsand@osd/dev-utils.Not in scope (separate follow-up PRs — major/breaking)
@hapi/content5→6 ·tar6→7 ·serialize-javascript→7 (×3) ·file-type16→21 (ESM-only) ·markdown-it13→14 · dev-onlyflatted@2.0.2viaflat-cache(theflatted/cjssubpath was removed in 3.x, so it can't simply be forced).Not applicable (no action)
hono,@hono/node-server,express-rate-limitare not present in any lockfile;path-to-regexpinstalled versions (1.9/3.3/6.3) are below the vulnerable>=8.0.0range.Verification
yarn install --frozen-lockfilepasses ("Already up-to-date") → lockfile consistent with all manifests.yarn osd bootstrap+ lint/tests should be run on a node-18 host/CI (the regeneration was done with a node-22 box since lockfile resolution is node-version-independent).