Compare commits

..

2 Commits

Author SHA1 Message Date
Chris Farhood 9836b5d070 Regenerate lockfile for lodash override
- Explicitly add lodash@4.18.1 to ensure override is respected
- Regenerated pnpm-lock.yaml with resolved lodash@4.18.1 (CVE fix)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-03 18:28:22 +00:00
Gandalf the Greybeard 6c1fdec0f6 fix: override lodash >=4.18.0 to patch code injection vulnerability
GHSA-r5fr-rjxr-66jc is a code injection vulnerability in lodash
below 4.18.0. The vulnerable transitive dependency comes through
@kinvolk/headlamp-plugin.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-23 10:58:22 +00:00
2 changed files with 635 additions and 1050 deletions
+1 -2
View File
@@ -47,7 +47,6 @@
"overrides": {
"tar": "^7.5.11",
"undici": "^7.24.3",
"vite": ">=6.4.2",
"lodash": ">=4.18.0"
}
}
}
+634 -1048
View File
File diff suppressed because it is too large Load Diff