Skip to content

Commit e4889b3

Browse files
authored
chore(deps): bump verdaccio to resolve dev dep security warnings (#7818)
Before: ``` js-yaml 4.0.0 - 4.1.0 Severity: moderate js-yaml has prototype pollution in merge (<<) - GHSA-mh29-5h37-fv8m fix available via `npm audit fix --force` Will install verdaccio@6.2.4, which is outside the stated dependency range node_modules/js-yaml @verdaccio/config <=8.0.0-next-8.25 Depends on vulnerable versions of js-yaml node_modules/@verdaccio/config @verdaccio/auth <=8.0.0-next-8.25 Depends on vulnerable versions of @verdaccio/config Depends on vulnerable versions of @verdaccio/signature node_modules/@verdaccio/auth verdaccio 5.20.1 - 6.2.1 || 7.0.0-next.0 - 8.0.0-next-8.25 Depends on vulnerable versions of @verdaccio/auth Depends on vulnerable versions of @verdaccio/config Depends on vulnerable versions of @verdaccio/middleware Depends on vulnerable versions of @verdaccio/signature Depends on vulnerable versions of @verdaccio/tarball Depends on vulnerable versions of @verdaccio/url Depends on vulnerable versions of verdaccio-audit node_modules/verdaccio @verdaccio/middleware <=8.0.0-next-8.25 Depends on vulnerable versions of @verdaccio/config Depends on vulnerable versions of @verdaccio/url node_modules/@verdaccio/middleware @verdaccio/signature <=8.0.0-next-8.17 Depends on vulnerable versions of @verdaccio/config node_modules/@verdaccio/signature verdaccio-audit 11.0.0-6-next.5 - 13.0.0-next-8.25 Depends on vulnerable versions of @verdaccio/config node_modules/verdaccio-audit validator <=13.15.20 Severity: high validator.js has a URL validation bypass vulnerability in its isURL function - GHSA-9965-vmph-33xx Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements - GHSA-vghf-hv5q-vc2g fix available via `npm audit fix --force` Will install verdaccio@6.2.4, which is outside the stated dependency range node_modules/validator @verdaccio/url <=13.0.0-next-8.24 Depends on vulnerable versions of validator node_modules/@verdaccio/url @verdaccio/tarball <=13.0.0-next-8.24 Depends on vulnerable versions of @verdaccio/url node_modules/@verdaccio/tarball 10 vulnerabilities (5 moderate, 5 high) ``` After: ``` audited 1450 packages in 1s found 0 vulnerabilities ``` The override is also no longer needed.
1 parent 31e8323 commit e4889b3

File tree

1 file changed

+0
-5
lines changed

1 file changed

+0
-5
lines changed

package.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -222,10 +222,5 @@
222222
"tests/**/*.test.cjs"
223223
]
224224
},
225-
"overrides": {
226-
"verdaccio": {
227-
"compression": "1.8.1"
228-
}
229-
},
230225
"packageManager": "npm@10.9.4+sha512.3a7506f37e85c1ba1021baad79f0cd9724748131f321fc117c4dc3ba235ec01be7327584a41d15117c01945560aa9373220628fcc1e1dddd877a5fe9b336a900"
231226
}

0 commit comments

Comments
 (0)