mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-10 12:28:27 +00:00
splitsec2
e33803cac2
Dependabot has four open npm alerts and no PRs for them, since they are all transitive. This updates the lockfiles only, no package.json change. | Package | From | To | Alert | |---|---|---|---| | socket.io-parser | 4.2.6 | 4.2.7 | zero-attachment memory exhaustion (high) | | ws | 8.18.3 | 8.21.3 | memory exhaustion DoS (high) and uninitialized memory disclosure (medium) | | engine.io-client | 6.6.4 | 6.6.7 | needed to get ws past its `~8.18` range | | baseline-browser-mapping | 2.9.19 | 2.11.31 | process termination on invalid input (medium, dev only) | I think the practical risk was low to begin with, since ws is only used by engine.io-client under Node and the built bundle doesn't include it. Still, it clears the alerts and the bumps are small. Done with npm 11 so the `libc` fields in the lockfile stay as they were. A clean `npm ci` from the new lockfile gives 0 vulnerabilities, and `tsc`, `vitest` (241 tests) and `vite build` all pass.
26 lines
678 B
JSON
26 lines
678 B
JSON
{
|
|
"name": "shelfmark",
|
|
"lockfileVersion": 3,
|
|
"requires": true,
|
|
"packages": {
|
|
"": {
|
|
"devDependencies": {
|
|
"baseline-browser-mapping": "^2.9.19"
|
|
}
|
|
},
|
|
"node_modules/baseline-browser-mapping": {
|
|
"version": "2.11.31",
|
|
"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.31.tgz",
|
|
"integrity": "sha512-b0k7wXlWjpuL/Uxb/pYlpjY0ej5BjAmurtPUk3eRGuloI4yjK32m8TiKUQ81l1ptcLjKS/KH2+uqIolZti1x4Q==",
|
|
"dev": true,
|
|
"license": "Apache-2.0",
|
|
"bin": {
|
|
"baseline-browser-mapping": "dist/cli.cjs"
|
|
},
|
|
"engines": {
|
|
"node": ">=6.0.0"
|
|
}
|
|
}
|
|
}
|
|
}
|