Commit 3d124ef
Fix critical vulnerabilities from daily dependency scan (#21402)
* Fix CVE-2026-33937: resolve handlebars to 4.7.9
grpc_tools_node_protoc_ts pins handlebars 4.7.7 and has no fixed
release. Use yarn resolutions to force 4.7.9 which patches the
JavaScript injection via AST type confusion vulnerability.
Co-authored-by: Ona <no-reply@ona.com>
* Fix protobufjs arbitrary code execution: bump to 7.5.5
Lockfile-only change. Both @grpc/proto-loader (^7.2.5) and ts-proto
(^7.2.4) already accept 7.5.5 via semver, so no package.json or
resolution changes needed.
Co-authored-by: Ona <no-reply@ona.com>
---------
Co-authored-by: Ona <no-reply@ona.com>1 parent 0900b8d commit 3d124ef
2 files changed
Lines changed: 9 additions & 20 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
37 | | - | |
| 37 | + | |
| 38 | + | |
38 | 39 | | |
39 | 40 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
8626 | 8626 | | |
8627 | 8627 | | |
8628 | 8628 | | |
8629 | | - | |
8630 | | - | |
8631 | | - | |
8632 | | - | |
8633 | | - | |
8634 | | - | |
8635 | | - | |
8636 | | - | |
8637 | | - | |
8638 | | - | |
8639 | | - | |
8640 | | - | |
8641 | | - | |
8642 | | - | |
8643 | | - | |
8644 | | - | |
| 8629 | + | |
| 8630 | + | |
| 8631 | + | |
| 8632 | + | |
8645 | 8633 | | |
8646 | 8634 | | |
8647 | 8635 | | |
| |||
13035 | 13023 | | |
13036 | 13024 | | |
13037 | 13025 | | |
13038 | | - | |
13039 | | - | |
13040 | | - | |
| 13026 | + | |
| 13027 | + | |
| 13028 | + | |
13041 | 13029 | | |
13042 | 13030 | | |
13043 | 13031 | | |
| |||
0 commit comments