Bugzilla – Attachment 194337 Details for
Bug 41587
node audit identified several vulnerable node dependencies
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 41587: (follow-up) Fix newly reported dependency vulnerabilities
80a7a1d.patch (text/plain), 1.91 KB, created by
Kyle M Hall (khall)
on 2026-03-02 12:29:55 UTC
(
hide
)
Description:
Bug 41587: (follow-up) Fix newly reported dependency vulnerabilities
Filename:
MIME Type:
Creator:
Kyle M Hall (khall)
Created:
2026-03-02 12:29:55 UTC
Size:
1.91 KB
patch
obsolete
>From 80a7a1df76573244bf5696f87f680156cb78f9f3 Mon Sep 17 00:00:00 2001 >From: Paul Derscheid <paul.derscheid@lmscloud.de> >Date: Mon, 2 Mar 2026 10:37:45 +0100 >Subject: [PATCH] Bug 41587: (follow-up) Fix newly reported dependency > vulnerabilities > >- Bump minimatch dependency and resolution from ^3.0.2 to ^3.1.4 (HIGH) >- Bump lodash dependency and resolution from ^4.17.12 to ^4.17.23 (MODERATE) >- Add resolution for fast-xml-parser ^4.5.4 (CRITICAL) >- Add resolution for undici ^6.23.0 (MODERATE) >- Add resolution for serialize-javascript ^7.0.3 (HIGH) > >Test plan: >- yarn audit --level high should show 0 vulnerabilities >- yarn build && yarn build:prod should complete without errors >- yarn cypress run should complete without (or currently expected) errors > >@RM: You will need to push yarn.lock as well > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> >--- > package.json | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > >diff --git a/package.json b/package.json >index 5796c3774f0..de76c3e98db 100644 >--- a/package.json >+++ b/package.json >@@ -33,9 +33,9 @@ > "gulp-sourcemaps": "^2.6.1", > "jquery": "^3.6.0", > "js-yaml": "^3.13.1", >- "lodash": "^4.17.12", >+ "lodash": "^4.17.23", > "merge-stream": "^2.0.0", >- "minimatch": "^3.0.2", >+ "minimatch": "^3.1.4", > "minimist": "^1.2.5", > "mysql": "^2.18.1", > "pinia": "^3.0.3", >@@ -68,14 +68,17 @@ > "url": "git://git.koha-community.org/koha.git" > }, > "resolutions": { >- "minimatch": "^3.0.2", >- "lodash": "^4.17.12", >+ "minimatch": "^3.1.4", >+ "lodash": "^4.17.23", > "form-data": "^2.5.4", > "braces": "^3.0.3", > "qs": "^6.14.1", > "micromatch": "^4.0.8", > "@cypress/request": "^3.0.0", >- "js-yaml": "^4.1.1" >+ "js-yaml": "^4.1.1", >+ "fast-xml-parser": "^4.5.4", >+ "undici": "^6.23.0", >+ "serialize-javascript": "^7.0.3" > }, > "author": "", > "license": "GPL-3.0", >-- >2.50.1 (Apple Git-155) >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 41587
:
191211
|
191212
|
191213
|
191215
|
191227
|
191228
|
194284
|
194335
|
194336
| 194337