This repository was archived by the owner on Nov 4, 2026. It is now read-only.
Repository navigation
build(frontend): Apply non-breaking npm audit fixes - #73
Merged
Merged
Conversation
Run npm audit fix (without --force) to update in-range transitive dependencies in the frontend lockfile. No package.json ranges change. Refs IE-93 Co-Authored-By: Matt Duncan <[email protected]>
The audit fix moved serialize-javascript from 6.0.0 to 6.0.2, which is still affected by GHSA-5c6j-r48x-rmvq (high) and fails dependency review. No react-scripts 5 dependency range allows the patched 7.x line, so pin it with an npm override. Refs IE-93
The audit fix moved webpack-dev-middleware from 5.3.1 to 5.3.4, which is still affected by GHSA-g84c-rxfj-3j2c (high) and fails dependency review. There is no patched 5.x release, so override it to ^7.4.6. The CRA dev server (webpack-dev-server 4.15.2) still starts, serves the bundle, and recompiles on change with this override. Refs IE-93
mrduncan
marked this pull request as ready for review
October 28, 2026 18:52
scttcper
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm auditreported 95 vulnerabilities (7 critical, 39 high) in the frontend lockfile. 71 of them can be fixed with in-range updates.This runs
npm audit fix(without--force) infrontend/and adds two npm overrides:@babel/traverse,form-data,loader-utils,proxy-addr,shell-quote,webpack,websocket-driver)overrides.serialize-javascript: ^7.0.3for GHSA-5c6j-r48x-rmvq (high). It is used at build time bycss-minimizer-webpack-pluginandrollup-plugin-terser, and noreact-scripts5 dependency range allows the patched 7.x line.overrides.webpack-dev-middleware: ^7.4.6for GHSA-g84c-rxfj-3j2c (high). It is only used by the CRA dev server (webpack-dev-server4.15.2), and there is no patched 5.x release. Version 7 is outsidewebpack-dev-server4's declared range, but the dev server still starts, serves the bundle, and recompiles on change with it.npm auditgoes from 95 to 31 (0 critical, 5 high). Most of the remaining ones come throughreact-scripts5, and npm only offers a breaking change to fix them.react-router-domresolves to 6.30.6, up from 6.2.x. That version logs v7 future-flag warnings in tests and the dev console.No other
package.jsonranges change.Refs IE-93
--
View Junior Session [Sentry]