Compare commits

...

2 Commits

Author SHA1 Message Date
Gandalf the Greybeard 4d80c2a541 fix: update package-lock.json to satisfy lodash override
The package.json override requires lodash >=4.18.0, but the lockfile
had 4.17.23. Regenerated lockfile with npm install --include=dev.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-26 21:30:04 +00:00
Gandalf the Greybeard ecd1e4db29 fix: override lodash >=4.18.0 to patch code injection vulnerability
GHSA-r5fr-rjxr-66jc is a code injection vulnerability in lodash
below 4.18.0. The vulnerable transitive dependency comes through
@kinvolk/headlamp-plugin.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-23 10:58:22 +00:00
2 changed files with 601 additions and 470 deletions
+599 -469
View File
File diff suppressed because it is too large Load Diff
+2 -1
View File
@@ -44,6 +44,7 @@
}, },
"overrides": { "overrides": {
"tar": "^7.5.11", "tar": "^7.5.11",
"undici": "^7.24.3" "undici": "^7.24.3",
"lodash": ">=4.18.0"
} }
} }