Skip to content

Patch dependency advisories that fail npm audit - #254

Open
rodgolpe wants to merge 2 commits into
masterfrom
fix/npm-audit-advisories
Open

rodgolpe wants to merge 2 commits into
masterfrom
fix/npm-audit-advisories

Conversation

@rodgolpe

@rodgolpe rodgolpe commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Patch the high-severity findings in happy-dom, follow-redirects, joi, and zod that fail the Test workflow audit job.
  • Bump Vitest to 4.1.12 so the moderate Vitest advisories drop out of npm audit.

Test plan

  • npm audit --audit-level=high --omit=optional exits 0
  • npm run test:unit (76 files, 694 tests)
  • npm run lint
  • Confirm the Test workflow audit job is green on this PR

minimatch below 11.0.1 remains a moderate finding. ESLint 9 and 10 still depend on minimatch 3 and 10, so npm run release (audit with no severity floor) will keep failing until ESLint moves to minimatch 11.

Made with Cursor

rodgolpe and others added 2 commits November 3, 2026 21:04
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant