mirror of
https://github.com/hyperdxio/hyperdx
synced 2026-04-21 13:37:15 +00:00
ef66cba8cd
## Summary Addresses npm security vulnerabilities in transitive dependencies. Prefer direct dependency upgrades over broad resolutions where possible. ## Changes **Direct upgrade:** - **`@slack/webhook`**: `^6.1.0` → `^7.0.0` — v7 natively uses axios v1, eliminating the axios@0.21.4 SSRF/redirect vulnerabilities. Only breaking change in v7 is dropping Node <18 (we're on Node 22). **Resolutions for transitive deps with no direct upgrade path:** - **`fast-xml-parser`**: `^4.4.0` — fixes prototype pollution (High) - **`systeminformation`**: `^5.24.0` — fixes command injection (High) ## Removed/Not Done - `axios` resolution removed — covered by the `@slack/webhook` upgrade instead - `tar` resolution removed — was a v6→v7 major jump on build-only tools (`cacache`, `node-gyp`); not present in the production image - `glob` resolution removed — was breaking test coverage tooling (`test-exclude@6` depends on glob@^7) ## Related Follow-up to #1731 which addressed base image vulnerabilities (Node, Go, ClickHouse). |
||
|---|---|---|
| .. | ||
| .storybook | ||
| pages | ||
| public | ||
| scripts | ||
| src | ||
| styles | ||
| tests/e2e | ||
| types | ||
| .Dockerignore | ||
| .env.development | ||
| .gitignore | ||
| .stylelintignore | ||
| CHANGELOG.md | ||
| Dockerfile | ||
| eslint.config.mjs | ||
| global-setup.js | ||
| jest.config.js | ||
| knip.json | ||
| mdx.d.ts | ||
| next.config.mjs | ||
| package.json | ||
| playwright.config.ts | ||
| postcss.config.cjs | ||
| stylelint.config.mjs | ||
| tsconfig.build.json | ||
| tsconfig.json | ||