Skip to content

fix: hight severity audit vulnerabilities#2750

Merged
DmitryAnansky merged 3 commits intomainfrom
fix/npm-autid-vulnarabilities
Apr 17, 2026
Merged

fix: hight severity audit vulnerabilities#2750
DmitryAnansky merged 3 commits intomainfrom
fix/npm-autid-vulnarabilities

Conversation

@DmitryAnansky
Copy link
Copy Markdown
Contributor

@DmitryAnansky DmitryAnansky commented Apr 17, 2026

What/Why/How?

Resolved high severity audit vulnerabilities by updating transitive dependency versions.

Reference

Testing

Screenshots (optional)

Check yourself

  • This PR follows the contributing guide
  • All new/updated code is covered by tests
  • Core code changed? - Tested with other Redocly products (internal contributions only)
  • New package installed? - Tested in different environments (browser/node)
  • Documentation update has been considered

Security

  • The security impact of the change has been considered
  • Code follows company security practices and guidelines

Note

Medium Risk
Primarily a dependency lockfile update, but it upgrades security-relevant libraries (e.g., dompurify) and other transitive packages, which could introduce subtle runtime or build behavior changes.

Overview
Updates package-lock.json to resolve reported high-severity npm audit issues by bumping transitive dependency versions.

Notable upgrades include basic-ftp 5.2.25.3.0, dompurify 3.3.33.4.0, and protobufjs 7.5.37.5.5.

Reviewed by Cursor Bugbot for commit ee71222. Bugbot is set up for automated code reviews on this repo. Configure here.

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 17, 2026

⚠️ No Changeset found

Latest commit: ee71222

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@DmitryAnansky DmitryAnansky marked this pull request as ready for review April 17, 2026 11:09
@DmitryAnansky DmitryAnansky requested review from a team as code owners April 17, 2026 11:09
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 79.94% (🎯 79%) 6732 / 8421
🔵 Statements 79.39% (🎯 79%) 6975 / 8785
🔵 Functions 83.16% (🎯 82%) 1368 / 1645
🔵 Branches 71.64% (🎯 71%) 4583 / 6397
File CoverageNo changed files found.
Generated in workflow #9485 for commit ee71222 by the Vitest Coverage Report Action

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

CLI Version Mean Time ± Std Dev (s) Relative Performance (Lower is Faster)
cli-latest 3.197s ± 0.039s ▓ 1.00x (Fastest)
cli-next 3.200s ± 0.024s ▓ 1.00x

@JLekawa JLekawa self-requested a review April 17, 2026 11:20
Comment thread .changeset/plenty-horses-agree.md Outdated
Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>
Comment thread package-lock.json
@DmitryAnansky DmitryAnansky merged commit 5d278c5 into main Apr 17, 2026
46 of 47 checks passed
@DmitryAnansky DmitryAnansky deleted the fix/npm-autid-vulnarabilities branch April 17, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants