Skip to content

fix(deps): security dependency bumps #10347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kwburns-kong wants to merge 22 commits into
base: develop
Choose a base branch
from
+1,738 −2,559
Open

fix(deps): security dependency bumps #10347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
ad6ab30
fix(deps): bump fast-uri to patch host-confusion SSRF vulnerabilities
kwburns-kong Aug 6, 2026
7d9a7b8
fix(deps): bump undici to patch cookie/cache/desync vulnerabilities
kwburns-kong Aug 6, 2026
0eae3aa
fix(deps): bump builder-util-runtime to patch credential-leak vulnera…
kwburns-kong Aug 6, 2026
56b35d9
fix(deps): bump liquidjs to patch memoryLimit bypass
kwburns-kong Aug 6, 2026
c9fbade
fix(deps): bump ip-address to patch octal/decimal parsing SSRF
kwburns-kong Aug 6, 2026
fd1715d
fix(deps): bump tar to patch PAX parsing and recursion DoS issues
kwburns-kong Aug 6, 2026
84a2ccc
fix(deps): bump ws to patch tiny-fragment memory exhaustion DoS
kwburns-kong Aug 6, 2026
a793411
fix(deps): bump hono to patch 33 advisories (cookie/CORS/routing/XSS)
kwburns-kong Aug 6, 2026
72287dd
fix(deps): bump valibot to patch flatten() TypeError on inherited keys
kwburns-kong Aug 6, 2026
bf1a5aa
fix(deps): bump dompurify to 3.4.13 (direct dep, lockfile refresh)
kwburns-kong Aug 6, 2026
79d222c
fix(deps): bump morgan to 1.11.0 (transitive via @react-router/serve)
kwburns-kong Aug 6, 2026
fed5733
fix(deps): bump uuid from v9 to v11 to patch buffer bounds check
kwburns-kong Aug 6, 2026
92854e7
fix(deps): bump csv-parse from v6 to v7
kwburns-kong Aug 6, 2026
5bb8af1
fix(deps): bump react-router family to 7.18.2 to patch CSRF/XSS/DoS a…
kwburns-kong Aug 6, 2026
bed5fc4
fix(deps): bump socket.io-parser to patch zero-attachment memory exha…
kwburns-kong Aug 6, 2026
55adf18
fix(deps): bump body-parser (via smoke-test's express) to patch limit…
kwburns-kong Aug 6, 2026
d3b643d
fix(deps): bump form-data to patch CRLF injection (2 of 3 instances)
kwburns-kong Aug 6, 2026
1508a08
fix(deps): bump @customerio/cdp-analytics-browser to patch nested js-…
kwburns-kong Aug 6, 2026
a444ab4
fix(deps): bump body-parser to 2.3.0 for the MCP SDK's bundled express
kwburns-kong Aug 6, 2026
d1eadc8
Merge branch 'develop' into sec/dep-bump
kwburns-kong Aug 7, 2026
a8c2bd8
Merge branch 'develop' into sec/dep-bump
kwburns-kong Aug 7, 2026
2d2c231
Merge branch 'develop' into sec/dep-bump
kwburns-kong Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading