Skip to content
This repository was archived by the owner on Apr 23, 2026. It is now read-only.

[Snyk] Fix for 7 vulnerabilities#18

Open
ghost wants to merge 1 commit into
mainfrom
snyk-fix-cd2af1cece89c9349136eb9f608da774
Open

[Snyk] Fix for 7 vulnerabilities#18
ghost wants to merge 1 commit into
mainfrom
snyk-fix-cd2af1cece89c9349136eb9f608da774

Conversation

@ghost

@ghost ghost commented Apr 18, 2026

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 7 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

  • packages/edp-form-extension/package.json
⚠️ Warning
Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Prototype Pollution
SNYK-JS-FLATTED-15700433
  275  
high severity Uncontrolled Recursion
SNYK-JS-FLATTED-15518041
  169  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-15309438
  169  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-15353387
  169  
high severity Inefficient Algorithmic Complexity
SNYK-JS-MINIMATCH-15353389
  169  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295
  155  
high severity Infinite loop
SNYK-JS-BRACEEXPANSION-15789759
  97  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

@ghost

ghost commented Apr 18, 2026

Copy link
Copy Markdown
Author

Merge Risk: High

This update includes a major version upgrade for ESLint from v8 to v9, which introduces significant breaking changes. The upgrade for @typescript-eslint/parser to v7 is primarily to align with the changes in ESLint v9.

eslint@8.57.1 → eslint@9.1.0 (HIGH RISK)

This is a major upgrade with several breaking changes that require developer action.

Key Breaking Changes:

  • New Configuration File Format: ESLint v9 now uses a eslint.config.js file (known as "flat config") by default. The traditional .eslintrc.* files are deprecated. You will need to migrate your existing configuration to the new format. To temporarily continue using your old config, you can set the ESLINT_USE_FLAT_CONFIG=false environment variable. [1, 4, 10]
  • Node.js Version Requirement: Support for Node.js versions older than 18.18.0 and 20.9.0 has been dropped. [10]
  • Removed Formatters: Several built-in formatters (compact, junit, visualstudio, etc.) have been removed from the core. If you use them, you must now install them as separate packages (e.g., eslint-formatter-compact). [1, 4]
  • Rule Changes: The require-jsdoc and valid-jsdoc rules have been removed. [1] Additionally, some rules have new default options which may result in new linting errors. For example, no-unused-vars now reports unused caught error variables by default. [6]

Recommendation:
It is highly recommended to follow the official ESLint v9 Migration Guide to update your configuration. You can use the npx @eslint/migrate-config command to help automate the conversion of your .eslintrc file. [3]

@typescript-eslint/parser@6.21.0 → @typescript-eslint/parser@7.6.0 (MEDIUM RISK)

This upgrade prepares for compatibility with ESLint v9.

Key Breaking Changes:

  • Node.js Version Requirement: Drops support for Node.js versions below 18.18.0, aligning with ESLint v9. [11]
  • Peer Dependencies: Requires an updated ESLint version (^8.56.0) and TypeScript version (>=4.7.4). [11]
  • Flat Config Support: Introduces a new typescript-eslint package to simplify configuration with ESLint's new flat config system. [11]

Source: ESLint v9 Migration Guide, typescript-eslint v7 Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@ghost

ghost commented Apr 18, 2026

Copy link
Copy Markdown
Author

Snyk checks have failed. 26 issues have been found so far.

Status Scan Engine Critical High Medium Low Total (26)
Open Source Security 3 23 0 0 26 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant