OmniRoute/changelog.d/fixes/sec-deps-dependabot-7.md at 90c70dd101a1de98cb1a913267094c9b801e51cd

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00

Files

Diego Rodrigues de Sa e Souza 90c70dd101 chore(deps): resolve 7 open Dependabot alerts via npm overrides (#8066 )

- fast-uri ^3.1.3 (root + electron overrides) — GHSA host confusion via IDN (#131, #126, high)
- hono ^4.12.27 (bump existing 4.12.25 override) — JSX context isolation / cx() XSS / v1 adapter req drop (#128/#129/#130, medium)
- @hono/node-server ^2.0.5 — serve-static path traversal (#127, medium); major bump, MCP transport verified
- body-parser ^2.3.0 — DoS on invalid limit (#125, low), via express 5

All four packages now clear in `npm audit`; lockfile-lint OK; vuln-ratchet advisory count reduced.
Electron lockfile updated for the second fast-uri site.

2026-07-21 22:36:35 -03:00

130 B

Raw Blame History

chore(deps): bump fast-uri≥3.1.3, hono≥4.12.27, @hono/node-server≥2.0.5, body-parser≥2.3.0 to clear 7 Dependabot alerts

130 B Raw Blame History

130 B

Raw Blame History