Skip to content

Commit 9cdab34

Browse files
committed
fix(security): resolve high dependency alerts
- Patch JavaScript audit overrides for high advisory transitive dependencies. - Update openssl and hickory resolver dependencies and adapt DNS resolver API usage. - Replace deterministic crypto test keys with generated keys to avoid hard-coded cryptographic values. Tests: npx --yes pnpm@9.15.9 ui:gate:static; npx --yes pnpm@9.15.9 test; npx --yes pnpm@9.15.9 test:security-regression; npx --yes pnpm@9.15.9 audit --audit-level high; npx --yes pnpm@9.15.9 git:guard:all; cd src-tauri && cargo check
1 parent 936daca commit 9cdab34

6 files changed

Lines changed: 265 additions & 155 deletions

File tree

package.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,12 +139,19 @@
139139
"pnpm": {
140140
"overrides": {
141141
"@lhci/cli>tmp": "^0.2.4",
142-
"basic-ftp": "^5.3.0",
143-
"commitizen>lodash": "^4.17.23",
142+
"basic-ftp": "^5.3.1",
143+
"commitizen>lodash": "^4.18.1",
144144
"eslint>ajv": "^6.14.0",
145145
"external-editor>tmp": "^0.2.4",
146+
"express>path-to-regexp": "0.1.13",
147+
"fast-uri": "^3.1.2",
146148
"flatted": "^3.4.2",
149+
"fdir>picomatch": "^4.0.4",
150+
"lodash": "^4.18.1",
151+
"lodash-es": "^4.18.1",
152+
"micromatch>picomatch": "^2.3.2",
147153
"minimatch": "^10.2.3",
154+
"tinyglobby>picomatch": "^4.0.4",
148155
"rollup": "^4.59.0",
149156
"tmp": "^0.2.4",
150157
"yauzl": "^3.2.1"

0 commit comments

Comments
 (0)