chore: fix dependency vulnerabilities (28 -> 8, all highs resolved)#1411
Merged
jbujula merged 1 commit intoJun 22, 2026
Merged
Conversation
Resolves all 9 high-severity npm-audit findings plus Dependabot alerts across transitive dev/runtime deps. Strategy: - Bump existing overrides to patched versions: basic-ftp ^6.0.1, serialize-javascript ^7.0.5, postcss ^8.5.15, qs ^6.15.2 - New flat overrides (single-major, single-instance, safe): tmp ^0.2.7, undici ^6.24.0, defu ^6.1.7, flatted ^3.4.2, form-data ^2.5.6, ip-address ^10.2.0, js-yaml ^4.2.0, lodash ^4.18.1 - Scoped overrides to avoid forcing inBundle siblings: tinyglobby>picomatch ^4.0.4 (leaves inBundle picomatch 2.3.2), tfx-cli>uuid ^13.0.1 (leaves inBundle uuid 3.4.0 under azure-pipelines-task-lib) - Direct dep bump: tar ^7.5.16 - Lock-file patch (Strategy C) for follow-redirects 1.15.11 -> 1.16.0; overrides cannot reach it (inBundle via bundled cli-wrapper subtree) Remaining 8 (down from 28) are documented accepted-risk/deferred: - 6 low: elliptic chain (GHSA-848j-6mx2-7j84, dev-only, no patch) - 2 moderate: uuid 3.4.0 bundled in azure-pipelines-task-lib (requires uuid ^3.0.1) -> needs upstream fix; cannot override a bundled subtree Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
aurorauser04
approved these changes
Jun 18, 2026
Quesadeha
approved these changes
Jun 18, 2026
brflood
approved these changes
Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-pick of #1410 to
release/stable.package-lock.jsonStrategy C patch for the bundledfollow-redirects1.15.11 → 1.16.0.Paired main PR
#1410
Known limitations / follow-ups
azure-pipelines-task-lib(pinsuuid ^3.0.1); needs upstream fix, cannot be overridden in a bundled subtree.Test plan
npm installcleannpm audit— 28 → 8 (all highs resolved; follow-redirects 1.16.0 verified)npm run ci— compile + lint + restore pass (unitTestexempt: fails only on local Node 24, passes on CI Node 20)🤖 Generated with Claude Code