GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — chore(deps): resolve npm audit vulnerabilities by dgreif · Pull Request #720 · github/eslint-plugin-github

Conversation

@dgreif

@dgreif dgreif commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Summary

npm audit currently reports seven vulnerabilities (5 high, 1 moderate, 1 low) in transitive dependencies. This updates the lockfile to patched releases so installs audit cleanly.

  • Updates vulnerable brace-expansion, fast-uri, js-yaml, and shell-quote paths.
  • Overrides Mocha's diff and serialize-javascript dependencies because Mocha 11's declared ranges do not include the patched major versions.
  • Removes the obsolete randombytes and safe-buffer transitive dependencies through the serialize-javascript update.

Validation

  • npm ci
  • npm test (67 passing)
  • npm audit (0 vulnerabilities)

Notes

TypeScript 7 from #719 is intentionally not included. The latest typescript-eslint release only supports TypeScript <6.1, and the upgrade currently breaks eslint-doc-generator.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dgreif
chore(deps): resolve npm audit vulnerabilities
a99ecda 
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 5c0da10f-9a59-4654-9fa0-67398b5fc746
Copilot AI review requested due to automatic review settings July 23, 2026 02:17
@dgreif
dgreif requested a review from a team as a code owner July 23, 2026 02:17
Copilot started reviewing on behalf of dgreif July 23, 2026 02:18
View session
Copilot AI reviewed Jul 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates transitive dependencies to patched versions so npm audit reports no vulnerabilities.

Changes:

  • Overrides Mocha’s vulnerable dependencies with patched major versions.
  • Refreshes vulnerable transitive packages and removes obsolete dependencies.
Show a summary per file
File Description
package.json Adds scoped Mocha dependency overrides.
package-lock.json Locks patched transitive dependency versions.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/2 changed files
  • Comments generated: 0
  • Review effort level: Medium

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
jibrang
jibrang approved these changes Jul 23, 2026
View reviewed changes
@dgreif
dgreif merged commit a95d9e7 into main Jul 23, 2026
11 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@dgreif
dgreif deleted the dgreif-fix-npm-vulnerabilities-tsc branch July 23, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jibrang jibrang jibrang approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@dgreif @jibrang
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.