chore: patch dependency vulnerabilities via npm audit fix #1

brendan · 2026-05-03T10:08:38Z

brendan commented

2026-05-03 10:08:38 +00:00

Resolves 7 advisories (1 critical, 3 high, 3 moderate) without
package.json range changes:

fast-jwt: algorithm confusion, cache key collision, ReDoS
fastify: content-type validation bypass, host spoofing
@fastify/static: path traversal & encoded-separator route bypass
vite (dev only): WS file read, fs.deny bypass, .map traversal
postcss/picomatch/brace-expansion (transitive): XSS, ReDoS, DoS

npm audit clean; 61 tests pass.

Resolves 7 advisories (1 critical, 3 high, 3 moderate) without package.json range changes: - fast-jwt: algorithm confusion, cache key collision, ReDoS - fastify: content-type validation bypass, host spoofing - @fastify/static: path traversal & encoded-separator route bypass - vite (dev only): WS file read, fs.deny bypass, .map traversal - postcss/picomatch/brace-expansion (transitive): XSS, ReDoS, DoS npm audit clean; 61 tests pass.

brendan added 1 commit 2026-05-03 10:08:38 +00:00

chore: patch dependency vulnerabilities via npm audit fix f27ba4922a

Resolves 7 advisories (1 critical, 3 high, 3 moderate) without
package.json range changes:
- fast-jwt: algorithm confusion, cache key collision, ReDoS
- fastify: content-type validation bypass, host spoofing
- @fastify/static: path traversal & encoded-separator route bypass
- vite (dev only): WS file read, fs.deny bypass, .map traversal
- postcss/picomatch/brace-expansion (transitive): XSS, ReDoS, DoS

npm audit clean; 61 tests pass.

brendan merged commit d30f40ca71 into main

2026-05-03 10:08:43 +00:00

brendan referenced this issue from a commit

2026-05-03 10:08:45 +00:00

Merge pull request 'chore: patch dependency vulnerabilities via npm audit fix' (#1) from chore/dependency-security-audit into main

brendan referenced this pull request

2026-05-13 19:01:58 +00:00

standardize every Node-based `Dockerfile` in `~/` on `FROM node:24-alpine` AND #15

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: brendan/nanodrop#1