fix: Vulnerabilities 9 (07/26) and fix eslint - #281
Merged
Conversation
Resolves 23 open Dependabot alerts across 13 packages (see docs/design/2026-07-24-dependabot-vulnerability-remediation-design.md).
Scope the pre-existing blanket minimatch@^10.2.3 override so @eslint/eslintrc keeps its own requested minimatch@^3.1.2. The blanket override was forcing minimatch's ESM build (which has never exported a default) into eslintrc's `import minimatch from "minimatch"`, breaking `npm run lint:check`. minimatch@3.1.2 is already patched against the known ReDoS advisory (fixed in 3.0.5), so this does not reintroduce any vulnerability, and every other consumer of minimatch in the tree remains on 10.2.5.
jsonc-eslint-parser@3.1.0 ships pure ESM with only named exports; importing it as a default import broke npm run lint:check on main, pre-dating this branch and uncaught by CI (which only runs prettier:check). Fixed as part of this vulnerability-remediation branch per explicit sign-off, since it was blocking a clean lint:check run for this work.
Documents the two authorized scope expansions (minimatch/eslintrc scoping, jsonc-eslint-parser import fix) and the honest final lint:check state, per final review feedback.
DavidJGapCR
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request primarily updates dependencies in
package.jsonand makes a minor import syntax adjustment ineslint.config.mjs. The most important changes are grouped below:Dependency updates and additions:
brace-expansiondependency override from version^5.0.6to^5.0.7to address potential bug fixes or security updates. (package.json)body-parser,form-data,axios,fast-uri,svgo,immutable,webpack-dev-server,piscina,launch-editor, andtmp, as well as nested dependency overrides forpostcss-svgo,@istanbuljs/load-nyc-config,@actions/http-client, and@eslint/eslintrc. (package.json)Code style and compatibility:
jsonc-eslint-parserfrom a default import to a namespace import (import * as parser from 'jsonc-eslint-parser') ineslint.config.mjsfor improved compatibility or correctness.This fix the following list https://github.com/Ed-Fi-Alliance-OSS/Ed-Fi-AdminApp/security/code-scanning/9
Warn: Project is vulnerable to: GHSA-42h9-826w-cgv3
Warn: Project is vulnerable to: GHSA-7q8q-rj6j-mhjq
Warn: Project is vulnerable to: GHSA-f4gw-2p7v-4548
Warn: Project is vulnerable to: GHSA-gcfj-64vw-6mp9
Warn: Project is vulnerable to: GHSA-hcpx-6fm6-wx23
Warn: Project is vulnerable to: GHSA-jqh4-m9w3-8hp9
Warn: Project is vulnerable to: GHSA-mmx7-hfxf-jppx
Warn: Project is vulnerable to: GHSA-mwf2-3pr3-8698
Warn: Project is vulnerable to: GHSA-pmv8-rq9r-6j72
Warn: Project is vulnerable to: GHSA-xj6q-8x83-jv6g
Warn: Project is vulnerable to: GHSA-v422-hmwv-36x6
Warn: Project is vulnerable to: GHSA-3jxr-9vmj-r5cp
Warn: Project is vulnerable to: GHSA-4c8g-83qw-93j6
Warn: Project is vulnerable to: GHSA-v2hh-gcrm-f6hx
Warn: Project is vulnerable to: GHSA-hmw2-7cc7-3qxx
Warn: Project is vulnerable to: GHSA-v56q-mh7h-f735
Warn: Project is vulnerable to: GHSA-xvcm-6775-5m9r
Warn: Project is vulnerable to: GHSA-52cp-r559-cp3m
Warn: Project is vulnerable to: GHSA-h67p-54hq-rp68
Warn: Project is vulnerable to: GHSA-v6wh-96g9-6wx3
Warn: Project is vulnerable to: GHSA-x9g3-xrwr-cwfg
Warn: Project is vulnerable to: GHSA-2p49-hgcm-8545
Warn: Project is vulnerable to: GHSA-7c78-jf6q-g5cm
Warn: Project is vulnerable to: GHSA-35p6-xmwp-9g52
Warn: Project is vulnerable to: GHSA-g8m3-5g58-fq7m
Warn: Project is vulnerable to: GHSA-p88m-4jfj-68fv
Warn: Project is vulnerable to: GHSA-vxpw-j846-p89q
Warn: Project is vulnerable to: GHSA-f5vj-f2hx-8m93
Warn: Project is vulnerable to: GHSA-m28w-2pqf-7qgj