Summary
npm audit reports vulnerabilities in transitive dependencies. Pin affected packages to patched versions using npm overrides to eliminate all reported vulnerabilities.
Vulnerabilities
| Package |
Override From |
Override To |
Advisory |
picomatch (^2) |
inherited |
2.3.2 |
ReDoS |
picomatch (^4) |
inherited |
4.0.4 |
ReDoS |
smol-toml |
inherited |
1.6.1 |
Prototype pollution |
yaml |
inherited |
2.8.3 |
Code execution via crafted YAML |
Acceptance Criteria
Notes
- Overrides are the recommended npm mechanism for pinning transitive dependency versions without forking direct dependencies.
- The
.cspell.json dictionary also needs smol added since the smol-toml package name triggers a spell-check failure.
Summary
npm auditreports vulnerabilities in transitive dependencies. Pin affected packages to patched versions using npmoverridesto eliminate all reported vulnerabilities.Vulnerabilities
picomatch(^2)picomatch(^4)smol-tomlyamlAcceptance Criteria
npm auditreports 0 vulnerabilitiesNotes
.cspell.jsondictionary also needssmoladded since thesmol-tomlpackage name triggers a spell-check failure.