Skip to content

Security: Address npm audit vulnerabilities#795

Merged
mcottontensor merged 2 commits intoEpicGamesExt:masterfrom
mcottontensor:vuln_fixes
Mar 17, 2026
Merged

Security: Address npm audit vulnerabilities#795
mcottontensor merged 2 commits intoEpicGamesExt:masterfrom
mcottontensor:vuln_fixes

Conversation

@mcottontensor
Copy link
Collaborator

@mcottontensor mcottontensor commented Mar 17, 2026

This PR resolves several security vulnerabilities identified by npm audit.

Changes

Dependency overrides (root package.json)

  • Added a global cross-spawn >=6.0.6 override to address a high severity ReDoS vulnerability (GHSA-3xgq-45jj-v275) present in pre-commit's pinned version
  • Broadened the existing glob override from a fs-routes-scoped fix to a global override, simplifying the configuration
  • Retained existing serialize-javascript and tar overrides from the previous dependabot fixes

Frontend library (Frontend/library/package.json)

  • Upgraded jest-environment-jsdom from ^29.7.0 to ^30.3.0 to resolve a vulnerability in the older version

Also includes the prior commit addressing dependabot issues in tar and express-rate-limit.

@changeset-bot
Copy link

changeset-bot bot commented Mar 17, 2026

⚠️ No Changeset found

Latest commit: fec4630

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@mcottontensor mcottontensor changed the title Addressing vulnerability issues. Security: Address npm audit vulnerabilities Mar 17, 2026
@mcottontensor mcottontensor merged commit 7252a11 into EpicGamesExt:master Mar 17, 2026
4 checks passed
@mcottontensor mcottontensor deleted the vuln_fixes branch March 17, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant