Skip to content

Conversation

@aarora79
Copy link
Contributor

Summary

Consolidates security fixes from multiple Dependabot PRs into a single update:

Test plan

  • Reviewed all dependency changes as Senior SDE - no breaking changes
  • Built frontend successfully with npm run build
  • Built and pushed new registry Docker image to ECR
  • Deployed to ECS and verified tasks are RUNNING and HEALTHY
  • Verified new image serves traffic correctly

Notes

Consolidates security fixes from multiple Dependabot PRs:
- PR #261: node-forge 1.3.1 -> 1.3.2 (CVE-2025-12816, CVE-2025-66031, CVE-2025-66030)
- PR #239: js-yaml 3.14.1 -> 3.14.2, 4.1.0 -> 4.1.1 (prototype pollution fix)
- PR #115: axios 1.10.0 -> 1.12.0 (bug fixes, type improvements)
- PR #97: form-data 3.0.3 -> 4.0.4 (crypto random for boundary values)
- PR #96: on-headers 1.0.2 -> 1.1.0, compression 1.8.0 -> 1.8.1 (CVE-2025-7339)

All changes verified to build successfully with no breaking changes.
@aarora79 aarora79 merged commit 823d255 into main Nov 30, 2025
3 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants