Skip to content

fix: override vulnerable dependencies (sha.js, Babel helpers/runtime) #5255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
adeelahmad6834 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: override vulnerable dependencies (sha.js, Babel helpers/runtime) #5255

adeelahmad6834 wants to merge 1 commit into from

Conversation

@adeelahmad6834
Copy link

@adeelahmad6834 adeelahmad6834 commented Sep 25, 2025

Summary

This PR updates Flowise’s dependency resolution to patch known vulnerabilities flagged by OWASP Dependency-Check:

  • sha.js: upgraded via override to >= 2.4.12
  • @babel/helpers and @babel/runtime: upgraded via override to >= 7.26.10
    • Advisory: GHSA-23rh-42f3-5vmq (Moderate)

Changes:

  • Added overrides block in root package.json
  • Regenerated pnpm-lock.yaml with pnpm install --lockfile-only

Security Rationale

  • Before: Security scans flagged 1 Critical (sha.js) and multiple Moderates.
  • After: Critical reduced to 0 in Dependency-Check rollup.

ASVS Reference

  • ASVS 14.2.2: Ensure components (libraries, frameworks) are up-to-date and verified against known vulnerabilities.
  • ASVS 14.2.4: Use software composition analysis to manage third-party components.

Impact

  • No runtime code changes.
  • Safe, minimal modification; improves supply chain security.
  • Validated with DevSecOps pipeline (artifacts available).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants

@adeelahmad6834 @adeel-plugit