From 65d83a78c6f6981b2aaed2ca2187dde6e3d94689 Mon Sep 17 00:00:00 2001 From: Paul Derscheid Date: Fri, 9 Jan 2026 17:08:11 +0100 Subject: [PATCH] Bug 41587: Fix critical and high severity node dependency vulnerabilities - Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH) - Add resolution for form-data ^2.5.4 (CRITICAL) - Add resolution for braces ^3.0.3 (HIGH) - Add resolution for qs ^6.14.1 (HIGH) Test plan: - yarn audit --level high should show 0 vulnerabilities - yarn build && yarn build:prod should complete without errors - yarn cypress run should return without (or currently expected) errors @RM: You will need to push yarn.lock as well Signed-off-by: David Nind --- package.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 2181728f4a..47b9e1d771 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "gulp": "^4.0.2", "gulp-autoprefixer": "^4.0.0", "gulp-concat-po": "^1.0.0", - "gulp-exec": "^4.0.0", + "gulp-exec": "^5.0.0", "gulp-rename": "^2.0.0", "gulp-rtlcss": "^1.4.1", "gulp-sass": "^5.1.0", @@ -68,7 +68,10 @@ }, "resolutions": { "minimatch": "^3.0.2", - "lodash": "^4.17.12" + "lodash": "^4.17.12", + "form-data": "^2.5.4", + "braces": "^3.0.3", + "qs": "^6.14.1" }, "author": "", "license": "GPL-3.0", -- 2.39.5