Compare commits

...

2 Commits

Author SHA1 Message Date
Chris Farhood d6fe575abf chore: regenerate pnpm-lock.yaml with elliptic override 2026-05-06 00:59:53 +00:00
Chris Farhood 5bc61a4e8d fix: add elliptic override for GHSA-848j-6mx2-7j84
Add pnpm.overrides.elliptic to prevent version regression on
the transitive elliptic vulnerability (CVE-2025-14505).

Vulnerability path:
@kinvolk/headlamp-plugin → vite-plugin-node-polyfills →
node-stdlib-browser → crypto-browserify → browserify-sign → elliptic

Note: pnpm audit will still report the vulnerability until
upstream publishes elliptic 6.6.2+. This override safeguards
against pulling a worse version.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-06 00:44:50 +00:00
2 changed files with 3 additions and 1 deletions
+2 -1
View File
@@ -38,7 +38,8 @@
"flatted": "^3.4.2",
"lodash": ">=4.18.0",
"picomatch": ">=4.0.4",
"vite": ">=6.4.2"
"vite": ">=6.4.2",
"elliptic": ">=6.6.1"
}
},
"devDependencies": {
+1
View File
@@ -11,6 +11,7 @@ overrides:
lodash: '>=4.18.0'
picomatch: '>=4.0.4'
vite: '>=6.4.2'
elliptic: '>=6.6.1'
importers: