Skip to content

Fix npm audit vulnerabilities#473

Merged
corinagum merged 2 commits into
mainfrom
fix/npm-audit-vulnerabilities
Mar 16, 2026
Merged

Fix npm audit vulnerabilities#473
corinagum merged 2 commits into
mainfrom
fix/npm-audit-vulnerabilities

Conversation

@heyitsaamir

@heyitsaamir heyitsaamir commented Mar 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Run npm audit fix to resolve 13 vulnerabilities in transitive dependencies (hono, @hono/node-server, express-rate-limit, flatted, js-yaml, minimatch, tmp)
  • Change botbuilder from 4.23.1 to ^4.23.1 in packages/botbuilder and change to 4.23.3 in examples/botbuilder to resolve the elliptic vulnerability chain

Test plan

  • Tested examples/mcp
  • Tested examples/mcpclient
  • Tested examples/botbuilder
  • npm audit returns 0 vulnerabilities

@heyitsaamir
Fix npm audit vulnerabilities
8992eb7 
- Run npm audit fix to resolve 13 vulnerabilities (hono, express-rate-limit,
  flatted, js-yaml, minimatch, tmp, @hono/node-server)
- Bump botbuilder from 4.23.1 to 4.23.3 to resolve elliptic vulnerability
  chain (elliptic → browserify-sign → crypto-browserify → botframework-connector)
heyitsaamir
heyitsaamir commented Mar 13, 2026
View reviewed changes
Comment thread packages/botbuilder/package.json Outdated
corinagum
corinagum previously approved these changes Mar 13, 2026
View reviewed changes
@corinagum
corinagum merged commit e875163 into main Mar 16, 2026
9 checks passed
@corinagum
corinagum deleted the fix/npm-audit-vulnerabilities branch March 16, 2026 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@corinagum corinagum corinagum approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@heyitsaamir @corinagum