Skip to content

[stable35] Fix npm audit - #1128

Open
nextcloud-command wants to merge 1 commit into
stable35from
automated/noid/stable35-fix-npm-audit
Open

nextcloud-command wants to merge 1 commit into
stable35from
automated/noid/stable35-fix-npm-audit

Conversation

@nextcloud-command

Copy link
Copy Markdown
Contributor

Audit report

This audit fix resolves 3 of the total 50 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

@vitest/coverage-istanbul #

  • Caused by vulnerable dependency:
  • Affected versions: 2.1.0-beta.1 - 4.1.10
  • Package usage:
    • node_modules/@vitest/coverage-istanbul

dompurify #

  • DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
  • Severity: low
  • Reference: GHSA-p98j-92pf-mc4p
  • Affected versions: <=3.4.15
  • Package usage:
    • node_modules/dompurify

vitest #

  • Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
  • Severity: moderate (CVSS 5.9)
  • Reference: GHSA-82fw-gwwq-j7x9
  • Affected versions: 2.1.0-beta.1 - 4.1.10
  • Package usage:
    • node_modules/vitest

Signed-off-by: GitHub <noreply@github.com>
@nextcloud-command nextcloud-command added 3. to review dependencies Pull requests that update a dependency file labels Oct 18, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant