chore(root): patch transitive security vulnerabilities#426
Merged
Conversation
Resolve CVEs in transitive dependencies: - undici 6.24.0 → 6.27.0 (CVE-2025-22620, memory exhaustion DoS) - ws ^7.5.10 → 7.5.11, ^8.x → 8.21.0 (memory exhaustion DoS) - express ^4.16.4/^4.18.2 → 4.22.2 (fixes transitive send CVE-2024-43799) - send 0.19.0 → 0.19.2 (CVE-2024-43799 XSS in error page) - serve-static 1.16.2 → 1.16.3 (uses patched send) AI-assistant: Claude (claude-sonnet-4-6)
Copilot created this pull request from a session on behalf of
magnusrand
June 22, 2026 20:20
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates root-level Yarn resolutions and regenerates the lockfile to patch known CVEs in transitive dependencies (not consumer-facing runtime/API changes to the design system packages).
Changes:
- Bumps/forces patched transitive versions for
undici,ws, andexpressvia rootresolutions. - Updates related transitive packages (
send,serve-static, etc.) as reflected inyarn.lock. - Regenerates
yarn.lockto lock the updated dependency graph.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
package.json |
Updates root resolutions to steer transitive dependencies to patched versions. |
yarn.lock |
Regenerated lockfile reflecting updated/patch-resolved versions (e.g., undici, ws, express, send, serve-static). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+230
to
+231
| "send@npm:0.19.0": "0.19.2", | ||
| "serve-static@npm:1.16.2": "1.16.3", |
|
Preview for this PR in https://entur-design-system--preview-426-copilot-fix-security-zzesudus.web.app |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
💡 Hvorfor?
Patcher kjente CVE-er i transitive avhengigheter:
undici6.24.0ws7.5.10 / 8.20.1send0.19.0express4.21.2send-sårbarhetserve-static1.16.2send🔧 Hvordan?
Resolution-overrides i root
package.json:undici: 6.24.0 → 6.27.0ws@npm:^7.5.10: 7.5.10 → 7.5.11ws@npm:^8.x / ~8.x: 8.20.1 → 8.21.0express@npm:^4.16.4/^4.18.2: 4.21.2 → 4.22.2 (pulls patchedsend~0.19.1 andserve-static~1.16.2)send@npm:0.19.0: → 0.19.2serve-static@npm:1.16.2: → 1.16.3Ingen endring for konsumenter — kun interne/transitive avhengigheter er oppdatert.
🧩 Type endring
🖼️ Skjermbilder
Ikke relevant.
💬 Tilleggsnotater
express4.22.2 er API-kompatibel med 4.21.2 (minor bump innenfor^4.x-range).ws7.5.11 er patch-bump for firebase-tools'^7.5.10-range.webpack-dev-middleware5.3.4 har ingen registrert advisory i GitHub Advisory DB per nå — ble ikke endret.yarn install --mode=update-lockfile. Fullyarn install+ build/test bør verifiseres i CI.💣 Breaking changes (om aktuelt)
Ingen. Alle oppgraderinger er innenfor eksisterende semver-ranges.
✅ Sjekkliste
🧪 Testing
Lockfile oppdatert med
--mode=update-lockfileuten feilBuild og tester bør verifiseres av CI
Testet med skjermleser
Testet i Safari og Firefox
Testet i dokumentasjonsiden