STOP-5391 : Update mocha version to resolve critical vulnerability#4
Merged
SB-ChetanKorde merged 6 commits intomasterfrom Mar 27, 2026
Merged
STOP-5391 : Update mocha version to resolve critical vulnerability#4SB-ChetanKorde merged 6 commits intomasterfrom
SB-ChetanKorde merged 6 commits intomasterfrom
Conversation
…ialize-javascript - Fixed diff DoS vulnerability via npm overrides (pinned to 5.2.1) - Updated all dependencies to latest secure versions - All 148 tests passing with 99.85% code coverage - Documented unavoidable serialize-javascript@7.0.2 RCE vulnerability that requires Node 20+ - Added SECURITY.md with vulnerability management policy - Production builds unaffected (mocha is dev-only dependency)
SB-ChetanKorde
requested review from
bhaskarsontakke,
pareshb3089 and
prafullaAtSB
- Ran npm audit fix to address identified security issues - Updated dependencies to secure versions - All 148 tests passing with maintained code coverage - Remaining 2 high-severity vulnerabilities documented in SECURITY.md (serialize-javascript and diff require Node 20+ for full patching) - Production builds remain unaffected (mocha is dev-only dependency)
- Added npm overrides for vulnerable transitive dependencies - Updated diff to 8.0.4 (fixes DoS vulnerability) - Updated serialize-javascript to 7.0.4 (fixes RCE vulnerability) - Updated brace-expansion to 5.0.5 (fixes ReDoS) - Updated minimatch to 9.0.9 (fixes ReDoS variants) - Zero vulnerabilities detected by npm audit - All 148 tests passing with 99.85% code coverage - Supports Node 14-24 with full security patching on Node 20+
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
We have critical vulnerability to resolve from this repo.
How Has This Been Tested?
Screenshot(s)/recordings(s)
Types of changes
Change in Package.json and package-lock.json file, upgrade package versions.
Update package patch version for this repo