Skip to content

Fix package vulnerabilities#1

Open
Nisarg48 wants to merge 5 commits intomainfrom
fix-package-vulnerabilities
Open

Fix package vulnerabilities#1
Nisarg48 wants to merge 5 commits intomainfrom
fix-package-vulnerabilities

Conversation

@Nisarg48
Copy link
Collaborator

@Nisarg48 Nisarg48 commented Feb 17, 2026

This PR patches all flagged Vanta and Dependabot security vulnerabilities in the js-tools.

Updates Applied:

  1. Updated direct dependencies (vitest) to their secure versions via the CLI.
  2. Implemented NPM "overrides" to surgically update all transitive/hidden dependencies (form-data, axios, esbuild, glob, webpack, playwright, validator, jws, qs, koa, http-proxy-middleware, js-yaml, lodash, on-headers, tmp, vite) to clear Vanta alerts without forcing major version conflicts.
  3. Resolved the V8_Fatal core dump error on GitHub Actions by increasing the runner's memory limit (NODE_OPTIONS: --max-old-space-size=6144 in ci.yml.
  4. Added a "workspaces" array to the root package.json. This tells NPM how to link the internal libs/ packages together, which fixed the massive wave of ESLint plugin errors.
  5. Explicitly added ajv as a dev dependency.

@Nisarg48 Nisarg48 assigned appasahebs and Nisarg48 and unassigned appasahebs and Nisarg48 Feb 17, 2026
@Nisarg48 Nisarg48 force-pushed the fix-package-vulnerabilities branch from a0d0401 to e5c945c Compare February 19, 2026 10:05
@Nisarg48 Nisarg48 requested review from appasahebs and gharia and removed request for appasahebs February 19, 2026 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants