Skip to content

fix(security): resolve high-severity dependency vulnerabilities - #722

Merged
davidmaronio merged 2 commits into
Iris-IV:mainfrom
Killerjunior:fix/dependency-vulnerabilities
Jul 12, 2026
Merged

fix(security): resolve high-severity dependency vulnerabilities#722
davidmaronio merged 2 commits into
Iris-IV:mainfrom
Killerjunior:fix/dependency-vulnerabilities

Conversation

@Killerjunior

Copy link
Copy Markdown
Contributor

Summary

Updated transitive dependencies with high-severity vulnerabilities (such as axios, ws, form-data, js-yaml, and @babel/core) to secure, patched versions.

  • Added overrides to package.json for npm users.
  • Created pnpm-workspace.yaml to configure overrides for pnpm v11+ (as pnpm v11 no longer supports the overrides field inside package.json).
  • Regenerated pnpm-lock.yaml and package-lock.json with secure dependency versions.

Closes #646

Type of Change

  • Bug fix
  • Feature
  • Chore / maintenance
  • Documentation
  • Test coverage

Contributor Checklist

  • Linked the related issue above.
  • Reviewed CONTRIBUTING.md for branch, commit, and PR title conventions.
  • Confirmed this follows the current Stellar Wave contribution flow, if applicable.
  • Added or updated tests when behavior changed.
  • Updated docs, examples, or translations when needed.

Validation

  • npm run lint
  • npm run format:check
  • npm run typecheck
  • npm test
  • npm run build
  • Not run; reason: Lockfile-only and configuration changes to address dependency vulnerabilities. Verified that npm audit and pnpm audit now show 0 vulnerabilities.

Notes for Reviewers

All packages with security vulnerabilities identified by pnpm audit and npm audit have been successfully mitigated.

@drips-wave

drips-wave Bot commented Jun 30, 2026

Copy link
Copy Markdown

@Killerjunior Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@sshdopey

Copy link
Copy Markdown
Contributor

Auto-review failed (API error). Leaving PR for human review.

@davidmaronio

Copy link
Copy Markdown
Contributor

clean security dep bump. one ci fix: prettier flags pnpm-workspace.yaml, run pnpm prettier --write pnpm-workspace.yaml and commit. the Playwright red is our shared broken e2e, ignore it.

@sshdopey

sshdopey commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Auto-review failed (API error). Leaving PR for human review.

@Killerjunior

Copy link
Copy Markdown
Contributor Author

Requested changes have been made and all checks have passed. Kindly review and merge.

@davidmaronio
davidmaronio merged commit fadd3e9 into Iris-IV:main Jul 12, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Dependencies have high severity vulnerabilities

3 participants