agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-12 13:13:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Pin argparse/underscore to 1.13.8 via yarn resolution (#33364)

Browse Source 
Fixes GHSA-cf4h-3jhx-xvhq (critical, arbitrary code execution) and
GHSA-qpx9-hpmf-5gmw (high, DoS via _.flatten/_.isEqual).

Vulnerable underscore@1.7.0 came from js-yaml@2.1.3 → argparse@0.1.16.
All other instances were already ≥1.13.8.

GitOrigin-RevId: b2ab4bc2682e19709694b7dd686134a439ade90c
This commit is contained in:
Lucie Germain
2026-05-22 08:06:48 +00:00
committed by Copybot
parent afaef6a1ef
commit 6fa708982b
2 changed files with 2 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+1
View File
@@ -32,6 +32,7 @@
"node": ">=20.0.0"
},
"resolutions": {
"argparse/underscore": "1.13.8",
"sandboxed-module": "patch:sandboxed-module@npm%3A2.0.4#~/.yarn/patches/sandboxed-module-npm-2.0.4-f8b45aacc9.patch",
"request/tough-cookie": "5.1.2",
"request/form-data": "2.5.5",