Skip to content

fix: npm package vulnerabilities - #69

Open
alronova wants to merge 1 commit into
inspektor-gadget:mainfrom
alronova:fix/pkg-vulnerabilities
Open

fix: npm package vulnerabilities#69
alronova wants to merge 1 commit into
inspektor-gadget:mainfrom
alronova:fix/pkg-vulnerabilities

Conversation

@alronova

@alronova alronova commented Mar 21, 2026

Copy link
Copy Markdown

Fix npm Packages Vulnerabilities

Fixed 23 vulnerabilities (8 low, 4 moderate, 11 high severity) using npm audit fix.
Added 1 package, removed 1 package, changed 73 packages, and audited 1297 packages.

Changes Made

Vulnerabilities Before

  • High: 11
  • Moderate: 4
  • Low: 8

Vulnerabilities After

  • High: 0
  • Moderate: 0
  • Low: 7 (all low-severity, related to elliptic)

Note

The low severity package vulnerabilities can also be fixed but they will introduce breaking changes to the project. Considering that, I ignored those vulnerabilities.

Testing done

  • npm install completes with only 7 low severity vulnerabilities warning
  • npm audit shows only low-severity issues remain
  • no breaking changes were introduced in this PR

I have signed-off my commits and rebased my branch with the latest commit on main.
@ashu8912 kindly review this PR whenever you get time.

@illume
illume requested a review from Copilot April 7, 2026 07:50

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@illume illume left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, can you please see if this is still needed?

Signed-off-by: alronova <aditya.divyam001@gmail.com>
@alronova
alronova force-pushed the fix/pkg-vulnerabilities branch from 7359771 to 0f0e0ad Compare April 15, 2026 06:00
@alronova

Copy link
Copy Markdown
Author

Thanks, can you please see if this is still needed?

Yes, this fix was indeed needed. I checked for the security vulnerabilities again on the latest codebase from main branch and there were 23 existing security vulnerabilities instead of 17 (which was the case earlier). I have fixed all of the high and moderate severity vulnerabilities and explained the implementation details in the above comment. Kindly take a look on this when you get time. Thanks!

@alronova

Copy link
Copy Markdown
Author

@illume @ashu8912 could you please review this PR?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants