Skip to content

Conversation

@katesaikishore
Copy link

@katesaikishore katesaikishore commented Dec 19, 2025

Description

This PR addresses a vulnerability in core-js@2.6.11 by upgrading it to version 2.6.12.
Since core-js is a transitive dependency (via @babel/polyfill -> auth0-extensions-cli), we have added core-js@2.6.12 as a direct dependency in package.json to force the use of the patched version.

Changes

  • Modified package.json to add "core-js": "2.6.12" to dependencies.
  • Updated yarn.lock to reflect the new dependency resolution.

Verification

The following tests were performed to verify the fix:

  1. Dependency Check: Ran yarn why core-js to confirm that core-js is resolved to 2.6.12.
  2. Build Verification: Ran npm run extension:build to ensure the extension builds successfully with the new dependency.
    • Note: For Node.js 18+, NODE_OPTIONS=--openssl-legacy-provider was used to bypass OpenSSL legacy provider issues.

Closes operational risk ticket for core-js@2.6.11.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant