Skip to content

Conversation

@naji247
Copy link
Member

@naji247 naji247 commented Nov 28, 2025

Summary

  • Remove dependency on redact-pii package due to its outdated transitive dependencies causing security vulnerabilities
  • Add pnpm overrides to pin vulnerable transitive dependencies to secure versions
  • Update dev dependencies to latest versions (vitest, eslint, etc.)

Security Fixes

The following vulnerabilities are addressed via pnpm overrides:

Package Vulnerability Source
js-yaml GHSA-mh29-5h37-fv8m (prototype pollution) @changesets/cli
tmp GHSA-52f5-9888-hmc6 (symlink attack) @changesets/cli
vite GHSA-93m4-6634-74q7 and others vitest
body-parser GHSA-wqch-xfxh-vrr4 (DoS via URL encoding) @modelcontextprotocol/sdk
brace-expansion GHSA-v6h2-p8h4-qcjw (ReDoS) eslint

Test plan

  • Run pnpm install to verify lock file resolves correctly
  • Run pnpm test to verify all tests pass
  • Run pnpm audit to verify no remaining vulnerabilities

brace-expansion 4.x is ESM-only, which breaks minimatch@3.x (CJS)
used by eslint. Version 2.0.2 fixes the ReDoS vulnerability while
remaining CJS-compatible.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants