Commit 354ca18
committed
fix: override protobufjs to >=7.5.6 to resolve CVE (GHSA-jvwf-75h9-cwgg)
protobufjs <7.5.6 is vulnerable to process-wide denial of service
through unsafe option paths. The vulnerable version (7.4.0) was pulled
in transitively via @atproto/bsky -> etcd3 -> @grpc/proto-loader.
Added a pnpm override to force protobufjs >=7.5.6 (resolved to 8.2.0).1 parent f19afe2 commit 354ca18
2 files changed
Lines changed: 13 additions & 68 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
37 | 42 | | |
38 | 43 | | |
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments