Fix undici and flatted security vulnerabilities#248
Merged
Bulzan Sergiu (busec0) merged 4 commits intomainfrom Mar 18, 2026
Merged
Fix undici and flatted security vulnerabilities#248Bulzan Sergiu (busec0) merged 4 commits intomainfrom
Bulzan Sergiu (busec0) merged 4 commits intomainfrom
Conversation
Bump vulnerable transitive dependencies: - undici 6.23.0 → 6.24.1 (3 WebSocket CVEs: memory, overflow, validation) - flatted 3.3.3 → 3.4.2 (unbounded recursion DoS in parse()) Resolves: SPO-218, SPO-219, SPO-220, SPO-221, SPO-222, SPO-223, SPO-224, SPO-225, SPO-226, SPO-227, SPO-228, SPO-229, SPO-230, SPO-231, SPO-232, SPO-233 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bulzan Sergiu (busec0)
requested a review
from Kristopher Johnson (kristopherjohnson)
as a code owner
Contributor
There was a problem hiding this comment.
Pull request overview
This PR pins transitive dependency versions (via overrides) to ensure specific versions of tar, undici, and/or flatted are used across the sample projects, and updates the relevant npm lockfiles where included.
Changes:
- Add/update
overridesentries to pinundiciandflatted(and keeptarpinned where already present). - Update
package-lock.jsonfiles to reflect the new resolved versions (React Native Expo + JavaScript Web).
Reviewed changes
Copilot reviewed 3 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| react-native-expo/package.json | Adds npm overrides for undici and flatted alongside existing pins. |
| react-native-expo/package-lock.json | Updates resolved dependency graph to match the pinned versions. |
| javascript-web/package.json | Adds npm overrides for flatted. |
| javascript-web/package-lock.json | Updates flatted resolution and related lockfile entries. |
| javascript-tui/package.json | Adds npm overrides for undici and flatted alongside existing tar pin. |
Files not reviewed (2)
- javascript-web/package-lock.json: Language not supported
- react-native-expo/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The overrides field is npm-only. Since this project uses yarn, the pins must also be in resolutions to take effect with yarn install --frozen-lockfile in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The lock file was previously generated with --legacy-peer-deps which produced a dependency tree out of sync with package.json, causing `npm ci` to fail in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Nick Robinson (nickrobinson)
approved these changes
Mar 18, 2026
Ben Chatelain (phatblat)
approved these changes
Mar 18, 2026
Alyssa Evans (alycda)
approved these changes
Mar 18, 2026
Kristopher Johnson (kristopherjohnson)
approved these changes
Mar 18, 2026
Bulzan Sergiu (busec0)
deleted the
sergiubulzan/fix-undici-flatted-vulnerabilities
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Affected quickstart apps:
react-native-expo(undici + flatted)javascript-tui(undici + flatted)javascript-web(flatted)Resolves: SPO-218, SPO-219, SPO-220, SPO-221, SPO-222, SPO-223, SPO-224, SPO-225, SPO-226, SPO-227, SPO-228, SPO-229, SPO-230, SPO-231, SPO-232, SPO-233
Test plan
npm auditshows no new high/critical vulnerabilities in affected lock files🤖 Generated with Claude Code