[GH-ISSUE #425] Security Alert: 12 npm vulnerabilities found #266

New issue

Closed

opened 2026-05-07 00:08:15 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:08:15 +02:00

Owner

Originally created by @github-actions[bot] on GitHub (Feb 18, 2026).
Original GitHub issue: https://github.com/maziggy/bambuddy/issues/425

Originally assigned to: @maziggy on GitHub.

Automated Security Audit Results

The weekly security audit found vulnerabilities in npm dependencies.

Package	Severity	Via	Fix
@eslint-community/eslint-utils	moderate	eslint	Yes
@eslint/eslintrc	moderate	ajv	Yes
@typescript-eslint/eslint-plugin	moderate	@typescript-eslint/parser, @typescript-eslint/type-utils, @typescript-eslint/utils, eslint	Yes
@typescript-eslint/parser	moderate	eslint	Yes
@typescript-eslint/type-utils	moderate	@typescript-eslint/utils, eslint	Yes
@typescript-eslint/utils	moderate	@eslint-community/eslint-utils, eslint	Yes
ajv	moderate	ajv	Yes
eslint	moderate	@eslint-community/eslint-utils, @eslint/eslintrc, ajv	Yes
eslint-plugin-react-refresh	moderate	eslint	No
typescript-eslint	moderate	@typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/utils, eslint	Yes

Recommended Actions

Review each vulnerability: npm audit
Auto-fix if possible: npm audit fix
Manual fix for breaking changes: npm audit fix --force (review changes!)
Close this issue when resolved

This issue was automatically created by the security audit workflow.

Originally created by @github-actions[bot] on GitHub (Feb 18, 2026). Original GitHub issue: https://github.com/maziggy/bambuddy/issues/425 Originally assigned to: @maziggy on GitHub. ## Automated Security Audit Results The weekly security audit found vulnerabilities in npm dependencies. | Package | Severity | Via | Fix | |---------|----------|-----|-----| | @eslint-community/eslint-utils | moderate | eslint | Yes | | @eslint/eslintrc | moderate | ajv | Yes | | @typescript-eslint/eslint-plugin | moderate | @typescript-eslint/parser, @typescript-eslint/type-utils, @typescript-eslint/utils, eslint | Yes | | @typescript-eslint/parser | moderate | eslint | Yes | | @typescript-eslint/type-utils | moderate | @typescript-eslint/utils, eslint | Yes | | @typescript-eslint/utils | moderate | @eslint-community/eslint-utils, eslint | Yes | | ajv | moderate | ajv | Yes | | eslint | moderate | @eslint-community/eslint-utils, @eslint/eslintrc, ajv | Yes | | eslint-plugin-react-refresh | moderate | eslint | No | | typescript-eslint | moderate | @typescript-eslint/eslint-plugin, @typescript-eslint/parser, @typescript-eslint/utils, eslint | Yes | ### Recommended Actions 1. Review each vulnerability: `npm audit` 2. Auto-fix if possible: `npm audit fix` 3. Manual fix for breaking changes: `npm audit fix --force` (review changes!) 4. Close this issue when resolved --- *This issue was automatically created by the security audit workflow.*

BreizhHardware

2026-05-07 00:08:15 +02:00

closed this issue
added the
dependencies

security

automated
labels

BreizhHardware commented

2026-05-07 00:08:16 +02:00

Author

Owner

@maziggy commented on GitHub (Feb 18, 2026):

commit bedcd0a73e (HEAD -> 0.2.1b, origin/0.2.1b)
Author: maziggy mz@v8w.de
Date: Wed Feb 18 09:30:29 2026 +0100

  1. ajv is only used by eslint to validate config schemas during linting
  2. It's a dev dependency, never reaches production
  3. The ReDoS requires crafted $data schema input — not an attack vector in a linting config

@maziggy commented on GitHub (Feb 18, 2026): commit bedcd0a73e07cca78d6eadec410d4d00da14e5d7 (HEAD -> 0.2.1b, origin/0.2.1b) Author: maziggy <mz@v8w.de> Date: Wed Feb 18 09:30:29 2026 +0100 1. ajv is only used by eslint to validate config schemas during linting 2. It's a dev dependency, never reaches production 3. The ReDoS requires crafted $data schema input — not an attack vector in a linting config