Bump NPM dependencies to resolve dependabot security alerts #236

New Issue

MrUnknownDE · 2026-04-05T16:23:20+02:00

MrUnknownDE commented

2026-04-05 16:23:20 +02:00

Originally created by @jnovinger on 3/4/2026

Proposed Changes

Bump the following NPM dependencies in netbox/project-static/ per open dependabot alerts:

minimatch 3.1.2 → 3.1.3 (transitive dep via eslint, eslint-plugin-import)
markdown-it 14.1.0 → 14.1.1 (transitive dep via netbox-graphiql → graphiql → @graphiql/react)

Justification

Two open dependabot security alerts:

minimatch (GHSA-7r86-cg39-jmmj) — High severity ReDoS via combinatorial backtracking in matchOne() with multiple non-adjacent GLOBSTAR segments
markdown-it (CVE-2026-2327) — Medium severity ReDoS

Both are patch-level bumps in transitive dependencies, resolved by updating yarn.lock.

*Originally created by @jnovinger on 3/4/2026* ### Proposed Changes Bump the following NPM dependencies in `netbox/project-static/` per open dependabot alerts: - `minimatch` 3.1.2 → 3.1.3 (transitive dep via eslint, eslint-plugin-import) - `markdown-it` 14.1.0 → 14.1.1 (transitive dep via netbox-graphiql → graphiql → @graphiql/react) ### Justification Two open dependabot security alerts: - **minimatch** ([GHSA-7r86-cg39-jmmj](https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj)) — High severity ReDoS via combinatorial backtracking in `matchOne()` with multiple non-adjacent GLOBSTAR segments - **markdown-it** ([CVE-2026-2327](https://nvd.nist.gov/vuln/detail/CVE-2026-2327)) — Medium severity ReDoS Both are patch-level bumps in transitive dependencies, resolved by updating `yarn.lock`.

MrUnknownDE closed this issue

2026-04-05 16:23:20 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#236