Repository navigation
fix(frontend/deps): resolve fast-uri and svgo high-severity advisories - #1486
Conversation
Two newly-published high-severity npm advisories were failing Security Scanning on main HEAD (and therefore blocking every open PR): - fast-uri GHSA-v2hh-gcrm-f6hx (host confusion via literal backslash authority delimiter; affected 3.0.0-3.1.3), pulled in transitively via ajv (ajv-formats and schema-utils dependency chains, webpack tooling). - svgo GHSA-2p49-hgcm-8545 (removeScripts plugin leaves some executable scripts intact; affected 4.0.0-4.0.1), pulled in transitively via postcss-svgo (css-minimizer-webpack-plugin / cssnano chain). Both fixed versions (fast-uri 3.1.4, svgo 4.0.2) already satisfy the existing semver ranges (^3.0.1, ^4.0.1), so `npm audit fix` bumps only the lockfile. No package.json change or overrides block needed, and no downgrades introduced. `npm audit` now reports 0 vulnerabilities. Verified: npm ci, webpack build, jest (2714 pass), tsc --noEmit, and eslint (0 errors) all succeed.
|
@coderabbitai review |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅ Action performedReview finished.
|
Summary
Clears the two newly-published high-severity npm advisories that are currently failing Security Scanning on
mainHEAD, which blocks every open PR in the repo.fast-uriajv(ajv-formats / schema-utils, webpack tooling)svgopostcss-svgo(css-minimizer-webpack-plugin / cssnano)Fix method
Both are transitive dev-dependencies. The fixed patch versions already satisfy the existing semver ranges (
^3.0.1,^4.0.1), sonpm audit fixbumps onlypackage-lock.json(6 lines). Nopackage.jsonchange oroverridesblock was needed, no downgrades, no breaking major bumps.npm auditnow reports 0 vulnerabilities.Verification
npm audit: 0 vulnerabilities (both target advisories gone)npm ci: exit 0npm run build(webpack): successnpm test(jest): 2714 passed, 1 skippedtsc --noEmit: cleaneslint: 0 errorsImpact
This unblocks Security Scanning across
mainand all currently-open PRs, so it is high-priority to merge.