fix: add elliptic override for GHSA-848j-6mx2-7j84 (#68)

privilegedescalation/headlamp-intel-gpu-plugin

Add pnpm.overrides.elliptic to prevent version regression on
the transitive elliptic vulnerability (CVE-2025-14505).

Vulnerability path:
@kinvolk/headlamp-plugin → vite-plugin-node-polyfills →
node-stdlib-browser → crypto-browserify → browserify-sign → elliptic

Note: pnpm audit will still report the vulnerability until
upstream publishes elliptic 6.6.2+. This override safeguards
against pulling a worse version.

Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>

This commit was merged in pull request #68.

This commit is contained in:

privilegedescalation-engineer[bot]

2026-05-06 00:43:51 +00:00

committed by

GitHub

parent c7920b5b8e

commit 32d825e441

1 changed files with 2 additions and 1 deletions

									
										package.json
									
		+2
		-1
	
												View File
												
				@@ -45,6 +45,7 @@

				  "overrides": {

				    "tar": "^7.5.11",

				    "undici": "^7.24.3",

				    "lodash": ">=4.18.0"

				    "lodash": ">=4.18.0",

				    "elliptic": ">=6.6.1"

				  }

				}