From 7e34a2bb013b0e2eeec398826d1dcfd0f6c4b037 Mon Sep 17 00:00:00 2001 From: Paul Derscheid Date: Mon, 2 Mar 2026 10:37:45 +0100 Subject: [PATCH] Bug 41587: (follow-up) Fix newly reported dependency vulnerabilities - Bump minimatch dependency and resolution from ^3.0.2 to ^3.1.4 (HIGH) - Bump lodash dependency and resolution from ^4.17.12 to ^4.17.23 (MODERATE) - Add resolution for fast-xml-parser ^4.5.4 (CRITICAL) - Add resolution for undici ^6.23.0 (MODERATE) - Add resolution for serialize-javascript ^7.0.3 (HIGH) Test plan: - yarn audit --level high should show 0 vulnerabilities - yarn build && yarn build:prod should complete without errors - yarn cypress run should complete without (or currently expected) errors @RM: You will need to push yarn.lock as well --- package.json | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 5796c3774f0..de76c3e98db 100644 --- a/package.json +++ b/package.json @@ -33,9 +33,9 @@ "gulp-sourcemaps": "^2.6.1", "jquery": "^3.6.0", "js-yaml": "^3.13.1", - "lodash": "^4.17.12", + "lodash": "^4.17.23", "merge-stream": "^2.0.0", - "minimatch": "^3.0.2", + "minimatch": "^3.1.4", "minimist": "^1.2.5", "mysql": "^2.18.1", "pinia": "^3.0.3", @@ -68,14 +68,17 @@ "url": "git://git.koha-community.org/koha.git" }, "resolutions": { - "minimatch": "^3.0.2", - "lodash": "^4.17.12", + "minimatch": "^3.1.4", + "lodash": "^4.17.23", "form-data": "^2.5.4", "braces": "^3.0.3", "qs": "^6.14.1", "micromatch": "^4.0.8", "@cypress/request": "^3.0.0", - "js-yaml": "^4.1.1" + "js-yaml": "^4.1.1", + "fast-xml-parser": "^4.5.4", + "undici": "^6.23.0", + "serialize-javascript": "^7.0.3" }, "author": "", "license": "GPL-3.0", -- 2.53.0