Skip to content

Fix npm audit vulnerabilities#157

Open
bghgary wants to merge 3 commits intoBabylonJS:mainfrom
bghgary:fix/npm-audit-fix
Open

Fix npm audit vulnerabilities#157
bghgary wants to merge 3 commits intoBabylonJS:mainfrom
bghgary:fix/npm-audit-fix

Conversation

@bghgary
Copy link
Copy Markdown
Contributor

@bghgary bghgary commented Apr 14, 2026

[Created by Copilot on behalf of @bghgary]

Fix npm audit vulnerabilities in the test project.

Changes

  • package-lock.json: Updated by npm audit fix for all non-breaking vulnerability fixes (ajv, brace-expansion, diff, glob, js-yaml, minimatch, picomatch, webpack).

Before: 11 vulnerabilities (2 low, 3 moderate, 6 high)
After: 2 vulnerabilities (2 high — both from mocha's serialize-javascript dependency, not exploitable in this context since it's only used for test bundling)

Supersedes #134.

Add serialize-javascript override (>=7.0.5) to resolve high-severity
RCE and DoS advisories. Run npm audit fix for remaining non-breaking
updates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 14, 2026 22:30
@bghgary bghgary mentioned this pull request Apr 14, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Tests npm dependencies to eliminate reported npm audit vulnerabilities, primarily by forcing a patched serialize-javascript version and refreshing the lockfile with non-breaking fixes.

Changes:

  • Add an npm overrides entry to force serialize-javascript >= 7.0.5.
  • Update Tests/package-lock.json via npm audit fix to pick up patched transitive dependency versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File Description
Tests/package.json Adds an overrides rule to remediate serialize-javascript advisories.
Tests/package-lock.json Updates resolved dependency graph to patched versions and reflects the serialize-javascript override.
Files not reviewed (1)
  • Tests/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bghgary and others added 2 commits April 14, 2026 15:55
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Mocha's serialize-javascript vulnerability is not exploitable in this
context (test bundling only). Keeping just the non-breaking npm audit
fixes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants