Skip to content

Update deps (fix vulnerability)#25

Closed
ibc wants to merge 2 commits intosindresorhus:mainfrom
ibc:update-deps
Closed

Update deps (fix vulnerability)#25
ibc wants to merge 2 commits intosindresorhus:mainfrom
ibc:update-deps

Conversation

@ibc
Copy link
Copy Markdown

@ibc ibc commented Mar 13, 2026

Details

  • Update all NPM deps to their latest available versions, and hence fix this vulnerability:

    file-type 13.0.0 - 21.3.0
    Severity: moderate
    file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - GHSA-5v7r-6r5c-r473

  • CI: Use Node 24, 22 and 20 (remove 18).

Before

npm audit --omit dev

# npm audit report

file-type  13.0.0 - 21.3.0
Severity: moderate
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - https://github.com/advisories/GHSA-5v7r-6r5c-r473
fix available via `npm audit fix --force`
Will install file-type@21.3.2, which is a breaking change
node_modules/file-type

1 moderate severity vulnerability

After

npm audit --omit dev

found 0 vulnerabilities

ibc added 2 commits March 13, 2026 16:31
# Details

Update all NPM deps to their latest available versions, and hence fix this vulnerability:

```
file-type  13.0.0 - 21.3.0
Severity: moderate
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - GHSA-5v7r-6r5c-r473
```

## Before

```
npm audit --omit dev

# npm audit report

file-type  13.0.0 - 21.3.0
Severity: moderate
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - GHSA-5v7r-6r5c-r473
fix available via `npm audit fix --force`
Will install file-type@21.3.2, which is a breaking change
node_modules/file-type

1 moderate severity vulnerability
```

## After

```
npm audit --omit dev

found 0 vulnerabilities
```
@ibc
Copy link
Copy Markdown
Author

ibc commented Mar 18, 2026

Friendly ping @sindresorhus

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant