Skip to content

Fix security vulnerabilities in dependencies#112

Closed
therealbrad wants to merge 1 commit intomainfrom
fix/security-vulnerabilities
Closed

Fix security vulnerabilities in dependencies#112
therealbrad wants to merge 1 commit intomainfrom
fix/security-vulnerabilities

Conversation

@therealbrad
Copy link
Contributor

Summary

  • Updates dompurify, hono, @hono/node-server, multer to patched versions (testplanit)
  • Runs npm audit fix in forge-app to resolve transitive vulnerabilities
  • Should resolve ~25-30 of the 41 open Dependabot security alerts

Remaining (unfixable without major bumps)

  • minimatch (locked by eslint-config-next)
  • serialize-javascript (transitive)
  • immutable (locked by swagger-ui-react)
  • svgo (locked by @svgr/webpack)
  • pm2 (no patch available)
  • forge-app: undici, webpack (locked by @forge/cli)

Test plan

  • CI passes
  • Verify Dependabot alert count drops after merge

Generated with Claude Code

Update dompurify, hono, @hono/node-server, and multer to patched
versions in testplanit. Run npm audit fix in forge-app to resolve
transitive dependency vulnerabilities.

Remaining unresolvable vulns are in transitive deps locked by
eslint-config-next, shadcn, swagger-ui-react, @svgr/webpack, and pm2.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@therealbrad therealbrad closed this Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant