Skip to content

fix(deps): resolve 3 security vulnerabilities#80

Merged
chibat merged 1 commit intochibat:mainfrom
theluckystrike:fix/security-dependency-updates
Mar 3, 2026
Merged

fix(deps): resolve 3 security vulnerabilities#80
chibat merged 1 commit intochibat:mainfrom
theluckystrike:fix/security-dependency-updates

Conversation

@theluckystrike
Copy link
Copy Markdown

Summary

Resolves 3 security vulnerabilities in dependencies.

Security fixes:

Testing

  • ✅ npm run build passes
  • ✅ npm test passes (2 tests)

Notes

  • serialize-javascript (via copy-webpack-plugin) requires a breaking change (v14) to fix
  • The fix is left for a future major version update

- minimatch: update to fix ReDoS (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74)
- ajv: update to fix ReDoS when using $data option (GHSA-2g4f-4pwh-qvx6)
- brace-expansion: update to fix ReDoS (GHSA-v6h2-p8h4-qcjw)

Note: serialize-javascript (via copy-webpack-plugin) requires breaking change (v14)
and is left for future update.
@theluckystrike
Copy link
Copy Markdown
Author

Resolves 3 security vulnerabilities in development dependencies. No changes to the starter template's runtime code or published artifacts.

@chibat chibat merged commit 867911a into chibat:main Mar 3, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants