LotusGuild/element-call
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive) #63

Merged
jared merged 1 commits from chore/dev-tool-security into lotus 2026-10-25 23:59:03 -04:00
Conversation 0 Commits 1 Files Changed 3
+444 -360
1 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 43cbd8409d chore(deps): security fixes for dev/build tooling (Storybook, Vitest, Vite, transitive)
CI / Build embedded bundle (push) Skipped
CI / Build embedded bundle (pull_request) Successful in 4m6s
Details
CI / Publish to Gitea npm registry (pull_request) Skipped
Details 
The npm advisory database flagged 19 packages in pnpm-lock.yaml. None of them
ship in the embedded call bundle (checked against the built dist); they run
on developer machines and in CI:
- storybook / @storybook/* 10.6.0 -> 10.6.3: critical, dev server code
  injection from the local network.
- vitest 4.1.12 (+ @vitest/ui unpinned to ^4.1.12), tinypool ^2.1.2:
  mock registration code injection, prototype-pollution RCE.
- vite ^8.3.5: dev-server file exposure, launch-editor issues.
- Overrides for transitive tooling: brace-expansion, browserslist,
  smol-toml, source-map-js, postcss-selector-parser, baseline-browser-
  mapping, fflate, pbkdf2, zod 4; existing qs/js-yaml/undici/dompurify
  overrides raised to the fixed versions.

Left: elliptic (no fixed release, low), zod 3 (no 3.x fix; a dependency
pins it). Lotus unit tests 144/144, build:embedded OK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-25 23:50:09 -04:00