Bug 41587: Fix critical and high severity node dependency vulnerabilities

- Upgrade gulp-exec to ^5.0.0 (fixes lodash.template HIGH)
- Add resolution for form-data ^2.5.4 (CRITICAL)
- Add resolution for braces ^3.0.3 (HIGH)
- Add resolution for qs ^6.14.1 (HIGH)

Test plan:
- yarn audit --level high should show 0 vulnerabilities
- yarn build && yarn build:prod should complete without errors
- yarn cypress run should return without (or currently expected) errors

@RM: You will need to push yarn.lock as well

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
This commit is contained in:
Paul Derscheid 2026-01-09 17:08:11 +01:00 committed by Martin Renvoize
parent e403698cd2
commit 8dd068675b
No known key found for this signature in database
GPG Key ID: 2D86E0EAEC83711B
1 changed files with 5 additions and 2 deletions

View File

@ -26,7 +26,7 @@
"gulp": "^4.0.2",
"gulp-autoprefixer": "^4.0.0",
"gulp-concat-po": "^1.0.0",
"gulp-exec": "^4.0.0",
"gulp-exec": "^5.0.0",
"gulp-rename": "^2.0.0",
"gulp-rtlcss": "^1.4.1",
"gulp-sass": "^5.1.0",
@ -69,7 +69,10 @@
},
"resolutions": {
"minimatch": "^3.0.2",
"lodash": "^4.17.12"
"lodash": "^4.17.12",
"form-data": "^2.5.4",
"braces": "^3.0.3",
"qs": "^6.14.1"
},
"author": "",
"license": "GPL-3.0",