security: add npm overrides for glob and jspdf vulnerabilities #81
Conversation
- Added npm overrides to enforce secure versions - glob: >=13.0.0 (was 7.2.3 in nested dependencies) - jspdf: >=3.0.2 (upgraded from 3.0.1 to 3.0.4) - All security requirements now met
There was a problem hiding this comment.
Pull request overview
This PR addresses security vulnerabilities by adding npm overrides to enforce secure versions of glob and jspdf packages. The changes upgrade glob from v7.2.3 (deprecated and vulnerable) to v13.0.0, and jspdf from v3.0.1 to v3.0.4, addressing Dependabot security alert #79.
Key Changes
- Added npm
overridessection to package.json with version constraints for glob (>=13.0.0) and jspdf (>=3.0.2) - Upgraded glob from v7.2.3 to v13.0.0, a major version jump that removes deprecated dependencies and introduces Node 20+ requirement
- Upgraded jspdf from v3.0.1 to v3.0.4, replacing deprecated atob/btoa dependencies with fast-png
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| firebird-ng/package.json | Added overrides section to force secure versions of glob and jspdf packages |
| firebird-ng/package-lock.json | Updated dependency tree with glob v13.0.0 and jspdf v3.0.4, removed deprecated transitive dependencies (inflight, @isaacs/cliui, jackspeak, etc.) |
Files not reviewed (1)
- firebird-ng/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "webpack-bundle-analyzer": "^4.10.2" | ||
| }, | ||
| "overrides": { | ||
| "glob": ">=13.0.0", |
There was a problem hiding this comment.
The glob override constraint >=13.0.0 may be too permissive for a major version change. Since glob v13 represents a major version jump from the previous v7 (skipping v8-12), there could be breaking API changes. Consider using a more restrictive constraint like ^13.0.0 to prevent automatic upgrades to potentially incompatible v14+ in the future, while still allowing patch and minor updates within v13.x.
| "glob": ">=13.0.0", | |
| "glob": "^13.0.0", |
| }, | ||
| "overrides": { | ||
| "glob": ">=13.0.0", | ||
| "jspdf": ">=3.0.2" |
There was a problem hiding this comment.
The jspdf override constraint >=3.0.2 may be too permissive. Consider using ^3.0.2 instead to prevent automatic upgrades to potentially incompatible v4+ in the future. This provides the security fix while maintaining semver-compatible upgrades within v3.x only.
| "jspdf": ">=3.0.2" | |
| "jspdf": "^3.0.2" |
| "overrides": { | ||
| "glob": ">=13.0.0", | ||
| "jspdf": ">=3.0.2" | ||
| }, |
There was a problem hiding this comment.
The glob v13 upgrade introduces a Node.js version requirement (Node 20 or >=22). Consider adding an "engines" field to package.json to explicitly document this requirement:
"engines": {
"node": "20 || >=22"
}This will help prevent installation issues for developers using older Node versions.
|
Lets put them under this It needs to be updated in coordination and testing. |
Briefly, what does this PR introduce?
What kind of change does this PR introduce?