Frontend: npm audit fix for shell-quote, form-data, and ws. (#535)

Browse source

Applies non-breaking transitive lockfile bumps for three still-present
advisories on the app dependency tree:

* shell-quote 1.8.0 -> 1.10.0 (critical: unescaped newlines in quote())
* form-data 3.0.4 -> 3.0.5 / 4.0.4 -> 4.0.6 (high: CRLF injection via
  unescaped multipart field names/filenames)
* ws 7.5.10 -> 7.5.12 / 8.18.3 -> 8.21.1 (high: memory-exhaustion DoS)

package-lock.json only; no package.json / direct-dependency changes. Runs
`npm audit fix` without --force, so no breaking dev-chain (react-scripts)
upgrades are pulled in. Verified on trixie/Node 20: jest 760/760 and the
production build both green.

Supersedes the stale dependabot PRs #487 (ws), #486 (form-data), and
equal-or-newer patched versions.

Co-authored-by: Roland <roland.henrie@o2x.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

lrnselfreliance 2026-07-14 20:32:23 -06:00 • committed by Roland

parent 9e92732a0c

commit 6266052998

No known key found for this signature in database

GPG key ID: 1BA620CE6C9A4680

1 changed files with 1184 additions and 901 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2085

app/package-lock.json generated

View file

File diff suppressed because it is too large Load diff