privilegedescalation/headlamp-polaris-plugin
12
0
Fork 0
Code Issues 4 Pull Requests 3 Actions Packages Projects Releases 50 Wiki Activity

fix: add elliptic override for GHSA-848j-6mx2-7j84 #142

Merged
privilegedescalation-engineer[bot] merged 2 commits from fix/elliptic-override-ghsa-848j-6mx2-7j84 into main 2026-05-06 02:14:10 +00:00
Conversation 10 Commits 2 Files Changed 2
+3 -279

2 Commits

Author SHA1 Message Date
Chris Farhood d6fe575abf chore: regenerate pnpm-lock.yaml with elliptic override 2026-05-06 00:59:53 +00:00
Chris Farhood 5bc61a4e8d fix: add elliptic override for GHSA-848j-6mx2-7j84 
Add pnpm.overrides.elliptic to prevent version regression on
the transitive elliptic vulnerability (CVE-2025-14505).

Vulnerability path:
@kinvolk/headlamp-plugin → vite-plugin-node-polyfills →
node-stdlib-browser → crypto-browserify → browserify-sign → elliptic

Note: pnpm audit will still report the vulnerability until
upstream publishes elliptic 6.6.2+. This override safeguards
against pulling a worse version.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-05-06 00:44:50 +00:00