SemianiakaVY/elsa-core
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

fix(deps): clear the 12 open npm advisories in both lockfiles (#7988)

Browse source 
All twelve Dependabot alerts on main were npm transitive dependencies in two
lockfiles, and all were build-time only. Worth saying plainly, because "10
high severity" reads worse than it is: fast-uri, nanoid, postcss, ws and
esbuild are dev dependencies of the webpack and remotion toolchains. Nothing
here reaches a published package.

ClientLib is fixed by a lockfile bump alone. Its dist/*.js is committed and
embedded into the assembly, so the check that matters is whether the shipped
artifact moved: rebuilding with the patched toolchain reproduces all three
files byte for byte, same md5, so it did not.

The readme-video project needed @remotion/cli and remotion moved from 4.0.469
to 4.0.516, which npm audit fix could not do on its own because both are
exact-pinned. The bump is non-major and carries the ws and esbuild fixes.

Both directories now report zero vulnerabilities. Clearing them is mostly
about signal: twelve standing alerts is how a real one goes unnoticed.
This commit is contained in:
Sipke Schoorstra 2026-08-25 06:19:16 +02:00 committed by GitHub
parent f969cd61e8
commit e460a12550
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 1338 additions and 452 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1774
design/video/elsa-readme-video/package-lock.json generated
View file

File diff suppressed because it is too large Load diff

4
design/video/elsa-readme-video/package.json
View file

@ -9,10 +9,10 @@
"still": "remotion still ElsaReadme ../exports/elsa-workflows-readme-poster.png --frame=36"
},
"dependencies": {
"@remotion/cli": "4.0.469",
"@remotion/cli": "4.0.516",
"react": "19.2.6",
"react-dom": "19.2.6",
"remotion": "4.0.469"
"remotion": "4.0.516"
},
"devDependencies": {
"@types/react": "19.2.14",

12
src/modules/Elsa.Expressions.JavaScript.Libraries/ClientLib/package-lock.json generated
View file

@ -633,9 +633,9 @@
"license": "MIT"
},
"node_modules/fast-uri": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
"version": "3.1.6",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
"integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
"dev": true,
"funding": [
{
@ -1877,9 +1877,9 @@
"dev": true
},
"fast-uri": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
"version": "3.1.6",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
"integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
"dev": true
},
"fastest-levenshtein": {