From dc0baf78f90b2169350500f4d678f2a1247298fd Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 22 Jul 2026 22:59:07 +0200 Subject: [PATCH] fix(frontend/deps): resolve fast-uri and svgo high-severity advisories Two newly-published high-severity npm advisories were failing Security Scanning on main HEAD (and therefore blocking every open PR): - fast-uri GHSA-v2hh-gcrm-f6hx (host confusion via literal backslash authority delimiter; affected 3.0.0-3.1.3), pulled in transitively via ajv (ajv-formats and schema-utils dependency chains, webpack tooling). - svgo GHSA-2p49-hgcm-8545 (removeScripts plugin leaves some executable scripts intact; affected 4.0.0-4.0.1), pulled in transitively via postcss-svgo (css-minimizer-webpack-plugin / cssnano chain). Both fixed versions (fast-uri 3.1.4, svgo 4.0.2) already satisfy the existing semver ranges (^3.0.1, ^4.0.1), so `npm audit fix` bumps only the lockfile. No package.json change or overrides block needed, and no downgrades introduced. `npm audit` now reports 0 vulnerabilities. Verified: npm ci, webpack build, jest (2714 pass), tsc --noEmit, and eslint (0 errors) all succeed. --- frontend/package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 2064f1da4..ca224a9ff 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -5510,9 +5510,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.3", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz", - "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ { @@ -10584,9 +10584,9 @@ } }, "node_modules/svgo": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz", - "integrity": "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz", + "integrity": "sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==", "dev": true, "license": "MIT", "dependencies": {