fix: patch high-severity vulnerabilities in picomatch and vite (#128)

Browse Source

* chore: replace Dependabot references with Renovate

- SECURITY.md: update to mention Renovate (org-wide Mend Renovate)
- PROJECT_ASSESSMENT.md: mark Renovate as integrated (org-wide config)

Closes PRI-389. Parent PRI-387.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix: override picomatch >=4.0.4 and vite >=6.4.2 to patch high-severity vulnerabilities

Resolves 3 high-severity vulnerabilities from pnpm audit:
- GHSA-c2c7-rcm5-vvqj: Picomatch ReDoS via extglob quantifiers (>=4.0.0 <4.0.4)
- GHSA-p9ff-h696-f583: Vite arbitrary file read via dev server WebSocket
- GHSA-4w7w-66w2-5vf9: Vite path traversal in optimized deps .map handling

Also addresses moderate GHSA-3v7f-55p6-f55p (picomatch method injection).

Remaining vulnerabilities (moderate/low) are in transitive dependencies
managed by @kinvolk/headlamp-plugin and @headlamp-k8s/eslint-config
which require upstream updates to those packages.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>

This commit was merged in pull request #128.

...

This commit is contained in:

privilegedescalation-engineer[bot]

2026-05-04 11:01:53 +00:00

committed by GitHub

parent 202ce66c61

commit aa1db9215a

4 changed files with 508 additions and 130 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

pnpm-lock.yaml

Generated

+503 -127

File diff suppressed because it is too large Load Diff