Skip to content

chore: resolve open dependabot security alerts#3

Draft
jonathannorris wants to merge 2 commits intomainfrom
chore/dependabot-alerts
Draft

chore: resolve open dependabot security alerts#3
jonathannorris wants to merge 2 commits intomainfrom
chore/dependabot-alerts

Conversation

@jonathannorris
Copy link
Copy Markdown
Member

Summary

Alert Package Severity Fix
#91 hono medium Overridden to >=4.12.16 via overrides (HTML injection)
#89 ip-address medium Overridden to >=10.1.1 via overrides (XSS in Address6)

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces an overrides section in package.json to enforce minimum versions for hono and ip-address, which are reflected in the package-lock.json updates. The review feedback correctly identifies that using the >= operator in overrides is risky and suggests pinning to specific versions with the caret ^ operator to prevent breaking major version upgrades.

Comment thread package.json Outdated
…5.1 and fast-uri 3.1.2

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris jonathannorris marked this pull request as draft May 8, 2026 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant