Skip to content

fix: dedupe dependencies and remove critical vulnerabilities - #41

Merged
5ZYSZ3K merged 1 commit into
mainfrom
fix/dedupe-dependencies-and-fix-critical-issues
May 29, 2026
Merged

fix: dedupe dependencies and remove critical vulnerabilities#41
5ZYSZ3K merged 1 commit into
mainfrom
fix/dedupe-dependencies-and-fix-critical-issues

Conversation

@5ZYSZ3K

Copy link
Copy Markdown
Collaborator

This repo contained 4 critical vulnerabilities in its dependencies
All were only in the dev environment

PackageAdvisoryIssueLink
handlebars@4.7.8GHSA-2w6w-674q-4c4qJavaScript Injection via AST Type ConfusionGHSA-2w6w-674q-4c4q
hermes-engine@0.5.1GHSA-7mhc-prgv-r3q4Access of Resource Using Incompatible TypeGHSA-7mhc-prgv-r3q4
hermes-engine@0.5.1GHSA-327c-qx3v-h673Always-Incorrect Control Flow ImplementationGHSA-327c-qx3v-h673
hermes-engine@0.5.1GHSA-mph8-6787-r8hwUse After FreeGHSA-mph8-6787-r8hw

This PR is meant to remove all of them, and to dedupe dependencies

@5ZYSZ3K
5ZYSZ3K requested a review from jsamrMay 28, 2026 18:45
@5ZYSZ3K5ZYSZ3K self-assigned this May 28, 2026
@codecov

codecovBot commented May 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.65%. Comparing base (327adbb) to head (d07aef1).

Additional details and impacted files
@@ Coverage Diff @@## main #41 +/- ##
=======================================
Coverage 98.65% 98.65% =======================================
Files 140 140 Lines 2085 2085 Branches 639 638 -1 =======================================
Hits 2057 2057 Misses 27 27 Partials 1 1 
FlagCoverage Δ
css-processor100.00% <ø> (ø)
render97.85% <ø> (ø)
transient-render-engine98.95% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@5ZYSZ3K
5ZYSZ3K merged commit b829513 into mainMay 29, 2026
8 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@5ZYSZ3K@jsamr