github-featured / learningcircuit--local-deep-research

发布

0 发布 174 Git 标签

RSS 订阅源
  • v1.5.5 81f95540e2
    比较

    fix(deps): add lodash/lodash-es overrides to prevent vulnerable transitive resolution (#3361)

    frostbyte_neo 发布于 2026-04-02 16:38:03 +00:00

    Adds explicit overrides for lodash and lodash-es (^4.18.0) in the
    accessibility tests package.json. This prevents transitive dependencies
    from resolving to versions <=4.17.23, which are affected by:

    • CVE-2026-4800 / GHSA-r5fr-rjxr-66jc (code injection via _.template)
    • CVE-2026-2950 / GHSA-f23m-r3pf-42rh (prototype pollution via _.unset)

    The lockfile was already bumped to 4.18.1 in #3360, but these overrides
    provide defense-in-depth against future resolution changes.

    下载附件