Skip to content

feat: security fixes + release (PROVCON-5665) - #2967

Merged
ben-smartbear merged 5 commits into
mainfrom
feature/provcon-5665--fix-security-issues
Aug 28, 2026
Merged

feat: security fixes + release (PROVCON-5665)#2967
ben-smartbear merged 5 commits into
mainfrom
feature/provcon-5665--fix-security-issues

Conversation

@ben-smartbear

Copy link
Copy Markdown
Contributor

Resolves outstanding Critical and High severity dependency alerts across the root workspace and both example apps (examples/react-cra, examples/angular) via yarn resolutions, without touching any application source code.

Critical fixes

  • form-data — unsafe random boundary generation → pinned to ^4.0.6
  • websocket-driver — message corruption via protocol length headers → pinned to ^0.7.5 (root + both examples)
  • shell-quote — newline escaping in .op values → pinned to 1.8.4, later superseded by the DoS fix below

High fixes

  • shell-quote — quadratic-complexity DoS in parse() → bumped to ^1.8.5
  • lodash / lodash.template — code injection via _.template → bumped to ^4.18.1 (not 4.18.0, which was deprecated/broken)
  • tar — four chained CVEs (race condition, hardlink traversal, symlink poisoning) → bumped to ^7.5.19, which also covers a newer decompression DoS not yet in the alert list
  • braces — uncontrolled resource consumption → bumped to ^3.0.3
  • node-forge — ASN.1 validator desync + signature verification → bumped to ^1.3.2
  • rollup — arbitrary file write via path traversal + DOM clobbering → bumped to ^4.59.0
  • piscina — prototype pollution gadget → bumped to ^4.9.3
  • @remix-run/router — XSS via open redirects → pinned to 1.23.2 (patch-level, no react-router-dom bump needed)
  • minimatch / webpack-dev-middleware — pinned per-major-line rather than globally, to avoid breaking consumers exact-pinned to older majors (see note below)

@ben-smartbear
ben-smartbear requested a review from a team as a code owner August 27, 2026 10:27
@netlify

netlify Bot commented Aug 27, 2026

Copy link
Copy Markdown

Deploy Preview for stoplight-elements-demo ready!

Name Link
🔨 Latest commit 49e4a42
🔍 Latest deploy log https://app.netlify.com/projects/stoplight-elements-demo/deploys/6a90292bca345400083ad6cb
😎 Deploy Preview https://deploy-preview-2967--stoplight-elements-demo.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify

netlify Bot commented Aug 27, 2026

Copy link
Copy Markdown

Deploy Preview for stoplight-elements ready!

Name Link
🔨 Latest commit 49e4a42
🔍 Latest deploy log https://app.netlify.com/projects/stoplight-elements/deploys/6a90292b5ad41b00080f3db7
😎 Deploy Preview https://deploy-preview-2967--stoplight-elements.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@ben-smartbear
ben-smartbear merged commit 2881a39 into main Aug 28, 2026
7 checks passed
@ben-smartbear
ben-smartbear deleted the feature/provcon-5665--fix-security-issues branch August 28, 2026 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants