Conversation
npm audit fix --package-lock-only, so nothing in any package.json moves and no dependency crosses a major. Takes the tree from 36 advisories to 32: three high and one moderate cleared, all of them transitive (undici, rollup, serialize-javascript and friends). What is left needs a major bump somewhere and is deliberately not in here. The one critical is not fixable at this level at all: it is vitest 3.2.4 inside the fingerprintjs submodule, and npm's proposed 'fix' is to downgrade the whole monorepo from the 4.1.10 every other package pins.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm audit fix --package-lock-only. Nopackage.jsonmoves and nothing crosses a major, so this is a lockfile-only change.36 advisories → 32: three high and one moderate cleared, all transitive (undici, rollup, serialize-javascript and friends).
On the critical one
It is not real for this repo, and it is not fixable here. GHSA-5xrq-8626-4rwp is
vitest< 3.2.6 — arbitrary file read/exec when the Vitest UI server is listening. Nothing in CI or production servesvitest --ui.The offending copy is
packages/fingerprintjs/node_modules/vitestat 3.2.4, i.e. a dev dependency of the vendored fingerprintjs submodule. Every package in this monorepo pins 4.1.10, which is well past the advisory range; npm's proposed--forcefix is to downgrade the whole tree to 3.2.7. Bumping it properly means a change inside the submodule.The remaining 32 all need a major bump somewhere and are left for a deliberate upgrade rather than folded in here.