Skip to content

chore(deps): update package versions due to new-found vulnerabilities#32984

Open
dmirgaev wants to merge 2 commits intoDevExpress:26_1from
dmirgaev:26_1__deps_update
Open

chore(deps): update package versions due to new-found vulnerabilities#32984
dmirgaev wants to merge 2 commits intoDevExpress:26_1from
dmirgaev:26_1__deps_update

Conversation

@dmirgaev
Copy link
Contributor

No description provided.

@dmirgaev dmirgaev self-assigned this Mar 19, 2026
Copilot AI review requested due to automatic review settings March 19, 2026 17:19
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates dependency resolutions to address newly identified vulnerabilities by adding pnpm overrides and refreshing the lockfile so vulnerable transitive versions are replaced with patched releases.

Changes:

  • Added pnpm overrides for flatted, undici, and socket.io-parser to enforce minimum safe versions.
  • Updated pnpm-lock.yaml to resolve flatted to 3.4.2, socket.io-parser to 4.2.6, and undici to 7.24.4.
  • Added an undici override to the packages/sbom package configuration.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File Description
pnpm-lock.yaml Applies the new overrides and updates resolved versions for vulnerable packages.
package.json Introduces root-level pnpm overrides to force patched dependency versions.
packages/sbom/package.json Adds a package-level pnpm override for undici in the SBOM package.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants