Repository navigation
chore(deps): refresh npm dependencies with published security fixes #3114
Description
Refresh npm dependencies in the lockfile: axios (8), tar (6), handlebars (4), path-to-regexp (3), minimatch (3), fast-uri (2), picomatch, underscore, jsonpath, glob, body-parser, http-proxy-middleware, lodash — 33 known CVEs total, including 2 critical (axios).
Key minimums: tar >= 7.5.11 (clears six advisories at once), current axios, handlebars, path-to-regexp, minimatch.
One dependency-update pass + image rebuild; verify with the standard build and e2e checks.
Activity
myasnikovdaniil commentedon Aug 15, 2026
Closing. Of the 13 packages named here, 9 are absent from the vendored console's lockfile entirely, including both criticals, and the remaining 4 are on versions past every advisory cited. The console was vendored into this repo on 2026-06-23 and its dependency tree is not the one this issue was filed against.