This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 841896a5cb Fixed: Two transitive npm dependency vulnerabilities
flagged by Dependabot security alerts
841896a5cb is described below
commit 841896a5cb3671f5f225f580afd0bc68c64e1536
Author: Mridul Pathak <[email protected]>
AuthorDate: Wed Sep 30 11:55:24 2026 +0530
Fixed: Two transitive npm dependency vulnerabilities flagged by Dependabot
security alerts
- Bump brace-expansion override in framework/rest-api from 5.0.9 to 5.0.12,
fixing DoS via uncontrolled recursion and quadratic-time expansion.
- Bump moment (via new override) in themes/common-theme's JS dependencies
from 2.30.1 to 2.31.0, fixing a path traversal vulnerability via crafted locale
names.
---
framework/rest-api/package-lock.json | 78 +++++++++++-----------
framework/rest-api/package.json | 2 +-
.../webapp/common-theme/js/package-lock.json | 6 +-
.../webapp/common-theme/js/package.json | 5 +-
4 files changed, 47 insertions(+), 44 deletions(-)
diff --git a/framework/rest-api/package-lock.json
b/framework/rest-api/package-lock.json
index 641a798e62..b20f3b39d8 100644
--- a/framework/rest-api/package-lock.json
+++ b/framework/rest-api/package-lock.json
@@ -44,9 +44,9 @@
"license": "MIT"
},
"node_modules/@nodable/entities": {
- "version": "3.0.0",
- "resolved":
"https://registry.npmjs.org/@nodable/entities/-/entities-3.0.0.tgz";,
- "integrity":
"sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==",
+ "version": "3.1.0",
+ "resolved":
"https://registry.npmjs.org/@nodable/entities/-/entities-3.1.0.tgz";,
+ "integrity":
"sha512-LsS/DjHr+uDM647Gru/cA8+J3a3HfhttwCKLyuoyN7yXTFCxKBtSgMQBvrW9yNPa2/zDRUNuGPaH5QUFoa4arQ==",
"funding": [
{
"type": "github",
@@ -78,9 +78,9 @@
"license": "MIT"
},
"node_modules/@redocly/openapi-core": {
- "version": "1.34.18",
- "resolved":
"https://registry.npmjs.org/@redocly/openapi-core/-/openapi-core-1.34.18.tgz";,
- "integrity":
"sha512-UyKIm0wTPw5BcY7Z2PkbK1Ma260um96LSBWXHrdSMe+ZV0EPMyDfAcUcjjm3qEiGST9OK/1TriekdPCZkn4Q3A==",
+ "version": "1.34.20",
+ "resolved":
"https://registry.npmjs.org/@redocly/openapi-core/-/openapi-core-1.34.20.tgz";,
+ "integrity":
"sha512-ypeBZ/6BKXR9+7/TtbKhbl4UgD7raHhPS12oknlKno2A8+lnFkxIwiE/Aklu6L2cd/ioH+fCWuMxi9/p3EyAPw==",
"license": "MIT",
"dependencies": {
"@redocly/ajv": "8.11.2",
@@ -88,7 +88,7 @@
"colorette": "1.4.0",
"https-proxy-agent": "7.0.6",
"js-levenshtein": "1.1.6",
- "js-yaml": "4.3.0",
+ "js-yaml": "4.3.2",
"minimatch": "5.1.9",
"pluralize": "8.0.0",
"yaml-ast-parser": "0.0.43"
@@ -179,9 +179,9 @@
}
},
"node_modules/brace-expansion": {
- "version": "5.0.9",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz";,
- "integrity":
"sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+ "version": "5.0.12",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz";,
+ "integrity":
"sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
@@ -374,9 +374,9 @@
"license": "MIT"
},
"node_modules/fast-xml-builder": {
- "version": "1.3.0",
- "resolved":
"https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.0.tgz";,
- "integrity":
"sha512-F74cZEdCvuw9P41GAC3rod4X04jjWGM1JPEv/GWSqFTWLsdyMSBMBMlm9Hk3GLBgLBbdBNY8yee0pQh2RBVESQ==",
+ "version": "1.3.1",
+ "resolved":
"https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz";,
+ "integrity":
"sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
"funding": [
{
"type": "github",
@@ -456,9 +456,9 @@
}
},
"node_modules/is-unsafe": {
- "version": "2.0.0",
- "resolved":
"https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.0.tgz";,
- "integrity":
"sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==",
+ "version": "2.0.2",
+ "resolved":
"https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.2.tgz";,
+ "integrity":
"sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==",
"funding": [
{
"type": "github",
@@ -758,9 +758,9 @@
}
},
"node_modules/openapi-sampler": {
- "version": "1.7.4",
- "resolved":
"https://registry.npmjs.org/openapi-sampler/-/openapi-sampler-1.7.4.tgz";,
- "integrity":
"sha512-CKS/rd5ucPCuEDbJnjGDXZTsuGWcmv53aCmQx7soZlPEONUGN4af0/dY5+THRFZraSEjeA78nlfzdFswC/N5SA==",
+ "version": "1.7.6",
+ "resolved":
"https://registry.npmjs.org/openapi-sampler/-/openapi-sampler-1.7.6.tgz";,
+ "integrity":
"sha512-MvWOm3vdgX7CZ6CNfu2wOFMGhC/pq03BxYTL/DKCkyPWfR6XIwUJnOV32mQGgCcUm1tY/y1jj7F2yqx1DieIWw==",
"license": "MIT",
"dependencies": {
"@types/json-schema": "^7.0.7",
@@ -844,9 +844,9 @@
}
},
"node_modules/react": {
- "version": "19.2.8",
- "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz";,
- "integrity":
"sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+ "version": "19.3.0",
+ "resolved": "https://registry.npmjs.org/react/-/react-19.3.0.tgz";,
+ "integrity":
"sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==",
"license": "MIT",
"peer": true,
"engines": {
@@ -854,16 +854,16 @@
}
},
"node_modules/react-dom": {
- "version": "19.2.8",
- "resolved":
"https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz";,
- "integrity":
"sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+ "version": "19.3.0",
+ "resolved":
"https://registry.npmjs.org/react-dom/-/react-dom-19.3.0.tgz";,
+ "integrity":
"sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q==",
"license": "MIT",
"peer": true,
"dependencies": {
- "scheduler": "^0.27.0"
+ "scheduler": "^0.28.0"
},
"peerDependencies": {
- "react": "^19.2.8"
+ "react": "^19.3.0"
}
},
"node_modules/react-is": {
@@ -953,9 +953,9 @@
}
},
"node_modules/scheduler": {
- "version": "0.27.0",
- "resolved":
"https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz";,
- "integrity":
"sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+ "version": "0.28.0",
+ "resolved":
"https://registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz";,
+ "integrity":
"sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==",
"license": "MIT",
"peer": true
},
@@ -1054,9 +1054,9 @@
}
},
"node_modules/strnum": {
- "version": "2.4.1",
- "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.1.tgz";,
- "integrity":
"sha512-M9eUSMT2dCB2cTNPG7UYj6KuK7RJR2SN2+yCV/fTW3xzTCS6EaGZ5pSMgDIjB7r8zSfTGk+dvvn9rTjpVS9Mwg==",
+ "version": "2.4.2",
+ "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.2.tgz";,
+ "integrity":
"sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==",
"funding": [
{
"type": "github",
@@ -1069,9 +1069,9 @@
}
},
"node_modules/styled-components": {
- "version": "6.5.1",
- "resolved":
"https://registry.npmjs.org/styled-components/-/styled-components-6.5.1.tgz";,
- "integrity":
"sha512-6AsQEXcG7QhtdzjwJ4s5Amx5R9veYH9AP3+U6nF2BAMU0i1iM3cAXKJXuAKZCdv3Y2ntVMcL44cPx4cIDxgYFg==",
+ "version": "6.5.3",
+ "resolved":
"https://registry.npmjs.org/styled-components/-/styled-components-6.5.3.tgz";,
+ "integrity":
"sha512-vAX79sfpmUerP9fsTTxoTrBDE0RuO4ahjInyWYoohNgqrdg63Ms4q6FJ/o2Fyity82NU3cujOT8Ewl9TThBdwg==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -1167,9 +1167,9 @@
"license": "BSD"
},
"node_modules/use-sync-external-store": {
- "version": "1.6.0",
- "resolved":
"https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz";,
- "integrity":
"sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
+ "version": "1.7.0",
+ "resolved":
"https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz";,
+ "integrity":
"sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==",
"license": "MIT",
"peerDependencies": {
"react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
diff --git a/framework/rest-api/package.json b/framework/rest-api/package.json
index 31f0c47ae2..dffc9ce8f5 100644
--- a/framework/rest-api/package.json
+++ b/framework/rest-api/package.json
@@ -10,7 +10,7 @@
"overrides": {
"js-yaml": "4.3.2",
"minimatch": "10.2.5",
- "brace-expansion": "5.0.9",
+ "brace-expansion": "5.0.12",
"fast-xml-parser": "5.10.1",
"dompurify": "3.4.13"
}
diff --git a/themes/common-theme/webapp/common-theme/js/package-lock.json
b/themes/common-theme/webapp/common-theme/js/package-lock.json
index 675e848c66..5acbdd56a8 100644
--- a/themes/common-theme/webapp/common-theme/js/package-lock.json
+++ b/themes/common-theme/webapp/common-theme/js/package-lock.json
@@ -186,9 +186,9 @@
"license": "MIT"
},
"node_modules/moment": {
- "version": "2.30.1",
- "resolved":
"https://registry.npmjs.org/moment/-/moment-2.30.1.tgz";,
- "integrity":
"sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
+ "version": "2.31.0",
+ "resolved":
"https://registry.npmjs.org/moment/-/moment-2.31.0.tgz";,
+ "integrity":
"sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
"license": "MIT",
"engines": {
"node": "*"
diff --git a/themes/common-theme/webapp/common-theme/js/package.json
b/themes/common-theme/webapp/common-theme/js/package.json
index 2633db7d77..b43a4c47a5 100644
--- a/themes/common-theme/webapp/common-theme/js/package.json
+++ b/themes/common-theme/webapp/common-theme/js/package.json
@@ -11,8 +11,8 @@
"featherlight": "^1.7.14",
"flot": "^4.2.6",
"inputmask": "^5.0.10",
- "jquery": "^4.0.0",
"jgrowl": "^1.5.1",
+ "jquery": "^4.0.0",
"jquery-jeditable": "^2.0.19",
"jquery-migrate": "^4.0.2",
"jquery-ui-dist": "^1.13.3",
@@ -27,6 +27,9 @@
"trumbowyg": "^2.31.0",
"uglify-js": "3.19.3"
},
+ "overrides": {
+ "moment": "^2.31.0"
+ },
"scripts": {
"uglify": "uglifyjs node_modules/flot/dist/es5/jquery.flot.js -c -m -o
node_modules/flot/dist/es5/jquery.flot.min.js"
}
