fix: add elliptic override for GHSA-848j-6mx2-7j84

Add pnpm.overrides.elliptic to prevent version regression on
the transitive elliptic vulnerability (CVE-2025-14505).

Vulnerability path:
@kinvolk/headlamp-plugin → vite-plugin-node-polyfills →
node-stdlib-browser → crypto-browserify → browserify-sign → elliptic

Note: pnpm audit will still report the vulnerability until
upstream publishes elliptic 6.6.2+. This override safeguards
against pulling a worse version.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
2026-05-05 18:07:58 +00:00
committed by Gandalf the Greybeard [agent]
parent 5b5ed9897b
commit 44d96aef57
+2 -1
View File
@@ -33,7 +33,8 @@
"overrides": {
"tar": "^7.5.11",
"undici": "^7.24.3",
"flatted": "^3.4.2"
"flatted": "^3.4.2",
"elliptic": ">=6.6.1"
}
},
"devDependencies": {