Skip to content

Add Vite client types, fix duplicate license key, update advisory status #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fimdim merged 2 commits into from
Oct 26, 2026
Merged

Add Vite client types, fix duplicate license key, update advisory status #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c032d9f
Add Vite client types, fix duplicate license key, update advisory status
fimdim Oct 26, 2026
fb7d686
Document body-parser upgrade as pending
fimdim Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,9 @@ The publication review on 2026-10-26 found no credential-pattern matches in the
| --- | --- | --- |
| Tinypool / Vitest mocker (through Vitest 3) | [GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3), [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr), [GHSA-82fw-gwwq-j7x9](https://github.com/advisories/GHSA-82fw-gwwq-j7x9), [GHSA-qxg6-89mg-rqv8](https://github.com/advisories/GHSA-qxg6-89mg-rqv8) | **Fixed** by upgrading to Vitest 5 (development only) |
| csv-parse 6 | [GHSA-8cw4-87c7-c6xx](https://github.com/advisories/GHSA-8cw4-87c7-c6xx) | **Fixed** by upgrading to csv-parse 7 |
| body-parser 2.x, through Express 5 | [GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828) (compressed-body DoS) | **Mitigated**: no patched 2.x release exists yet, so the JSON parser runs with `inflate: false` and rejects compressed request bodies (covered by a test). `npm audit` still reports it until upstream publishes a fix. |
| body-parser 2.x, through Express 5 | [GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828) (compressed-body DoS) | **Mitigated; dependency upgrade pending**: the lockfile currently resolves body-parser 2.3.0. A patched release, 2.4.0, is available; [PR #7](https://github.com/fimdim/github-engineering-insights/pull/7) proposes the upgrade. The JSON parser keeps `inflate: false` and rejects compressed request bodies (covered by a test). `npm audit` will continue to report this advisory until the patched dependency is installed. |

Do not use `npm audit fix --force` for the remaining entry: it would downgrade Express to 4.x.
Upgrade the remaining dependency to the patched release without downgrading Express; do not use `npm audit fix --force`.
This is a point-in-time review, not a security certification, exhaustive secret scan, or guarantee that future dependencies or commits are safe.

## Reporting vulnerabilities
Expand Down
1 change: 1 addition & 0 deletions apps/web/vite-env.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/// <reference types="vite/client" />
1 change: 0 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
"vite": "^7.2.0",
"vitest": "^5.0.5"
},
"license": "MIT",
"description": "Local-first DORA, SPACE and GitHub Copilot metrics dashboard for GitHub Enterprise Cloud",
"keywords": [
"dora",
Expand Down
Loading