chore: resolve CVE security vulnerabilities via package resolutions (HIGH / CRITICAL)#198
Open
chore: resolve CVE security vulnerabilities via package resolutions (HIGH / CRITICAL)#198
Conversation
…HIGH / CRITICAL) Add package resolutions to fix all critical and high severity CVE vulnerabilities detected in dependencies. Security fixes: - elliptic@^6.6.1 - Fixes critical CVE (private key extraction vulnerability) - glob@^10.5.0 - Fixes CVE-2025-64756 (command injection in CLI) - tmp@^0.2.4 - Fixes CVE-2025-54798 (arbitrary file write via symlink) - @babel/helpers@^7.26.10 - Fixes RegExp complexity vulnerability - js-yaml@^3.14.2 - Fixes prototype pollution vulnerability Results: - Eliminated all critical vulnerabilities (1 → 0) - Eliminated all high severity vulnerabilities (4 → 0) - Reduced moderate vulnerabilities (33 → 11) - Production dependencies: only 2 low severity issues remaining Build and ESLint checks pass successfully.
boazpoolman
requested changes
Nov 25, 2025
Member
boazpoolman
left a comment
boazpoolman
left a comment
There was a problem hiding this comment.
Thanks for this PR @MSACC. I've left some comments, could you address those? Apart from that it would be great if you could update all the Strapi packages as well in this PR.
boazpoolman
reviewed
Nov 25, 2025
Collaborator
Author
|
As discussed in our call @boazpoolman we will fix the tests later. Ready for review |
Add .nvmrc file specifying Node 20.18.1 LTS for consistent development environment. Update package.json engines to require Node 20-22 to align with security resolution requirements and ensure compatibility.
MSACC
force-pushed
the
chore/security-updates
branch
from
c50f77c to
290f8c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add package resolutions to fix all critical and high severity CVE vulnerabilities detected in dependencies.
Security fixes:
Results:
Build and ESLint checks pass successfully.