From 70b965c8ba841bd69a27ae6ff3ed034c489f8318 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 18:07:35 +0000 Subject: [PATCH] fix: add elliptic override for GHSA-848j-6mx2-7j84 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add pnpm.overrides.elliptic to prevent version regression on the transitive elliptic vulnerability (CVE-2025-14505). Vulnerability path: @kinvolk/headlamp-plugin → vite-plugin-node-polyfills → node-stdlib-browser → crypto-browserify → browserify-sign → elliptic Note: pnpm audit will still report the vulnerability until upstream publishes elliptic 6.6.2+. This override safeguards against pulling a worse version. Co-Authored-By: Paperclip --- package.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index 8fcefa9..941f81d 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,8 @@ "tar": "^7.5.11", "undici": "^7.24.3", "vite": ">=6.4.2", - "lodash": ">=4.18.0" + "lodash": ">=4.18.0", + "elliptic": ">=6.6.1" }, "dependencies": { "node-forge": "^1.4.0" -- 2.52.0