Skip to content

Security: Fix 4 vulnerable packages#60

Open
razorgupta wants to merge 2 commits intomasterfrom
security/sca-fix-1764846064
Open

Security: Fix 4 vulnerable packages#60
razorgupta wants to merge 2 commits intomasterfrom
security/sca-fix-1764846064

Conversation

@razorgupta
Copy link
Copy Markdown

Security Updates

This PR fixes security vulnerabilities found by Semgrep SCA.

✅ All packages validated for:

  • End of Life (EOL) status
  • Supply chain attack risks
  • Version stability (7-day cool-down or n-1 fallback)
  • Peer dependency compatibility

⚠️ Action Required:

  1. Run yarn install or npm install to regenerate lock file with fixed versions
  2. Run your build (yarn build / npm run build) to verify it compiles
  3. Run your test suite to verify compatibility
  4. Test in staging before merging to production

Updated Packages

NPM:

  • @babel/plugin-transform-runtime: transitive → 7.28.5
  • @babel/preset-env: transitive → 7.28.5
  • @babel/traverse: transitive → 7.28.5
  • rfc6902: transitive → 5.1.2

🔐 Vulnerabilities Fixed

📋 Semgrep Findings Addressed

Semgrep ID Link
152228753 View in Semgrep
152228754 View in Semgrep
68602661 View in Semgrep
68602671 View in Semgrep

Changes Made

  • Updated dependency files with secure versions
  • Regenerated lock files

This PR was created automatically by Security Bot
Please review and test before merging

Security fixes:
- @babel/plugin-transform-runtime: transitive → 7.28.5
- @babel/preset-env: transitive → 7.28.5
- @babel/traverse: transitive → 7.28.5
- rfc6902: transitive → 5.1.2

Addresses vulnerabilities:
- CVE-2023-45133
- CVE-2021-4245

Automated security fix by Security Bot
@razorgupta razorgupta added dependencies Pull requests that update a dependency file security automated labels Dec 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

automated dependencies Pull requests that update a dependency file security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant