Skip to content

chore(web): patch vulnerable transitive dependencies - #717

Open
markmur wants to merge 1 commit into
security/protocol-dependenciesfrom
security/web-dependencies
Open

chore(web): patch vulnerable transitive dependencies#717
markmur wants to merge 1 commit into
security/protocol-dependenciesfrom
security/web-dependencies

Conversation

@markmur

@markmur markmur commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Pin patched brace-expansion, fast-uri, and postcss releases.
  • Pin nanoid 3.x to 3.3.18, including the vulnerable copy not yet shown on the Dependabot dashboard.
  • Regenerate the Web lockfile without changing direct dependencies.

Stack

  1. chore(protocol): patch vulnerable transitive dependencies #716
  2. chore(web): patch vulnerable transitive dependencies #717
  3. chore(react-native): patch vulnerable transitive dependencies #718
  4. chore(react-native): replace vulnerable URI decoder #719

@markmur
markmur requested a review from a team as a code owner September 1, 2026 15:19
@github-actions github-actions Bot added the #gsd:50662 Rebase Checkout Kit on UCP label Sep 1, 2026
This was referenced Sep 1, 2026
Open
Open
Open
@markmur markmur self-assigned this Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@markmur markmur

Labels

#gsd:50662 Rebase Checkout Kit on UCP

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@markmur