fix(deps): security bumps for 12 Dependabot alerts#1993
Open
rtBot wants to merge 1 commit into
Open
Conversation
- dompurify override 3.4.5 -> 3.4.11 (GHSA-cmwh-pvxp-8882, -vxr8-fq34-vvx9, -gvmj-g25r-r7wr, -rp9w-3fw7-7cwq, -76mc-f452-cxcm, -hpcv-96wg-7vj8, -r47g-fvhr-h676) - ws override <8.21.0:8.21.0 (GHSA-96hv-2xvq-fx4p) - form-data -> 4.0.6 (GHSA-hmw2-7cc7-3qxx) - launch-editor -> 2.14.1 (GHSA-v6wh-96g9-6wx3) - @babel/core devDep + override -> 7.29.6 (GHSA-4x5r-pxfx-6jf8) - posthog-js ^1.282.0 -> ^1.386.8, removing vulnerable protobufjs (GHSA-wcpc-wj8m-hjx6, -f38q-mgvj-vph7) and @opentelemetry/core 2.x copies (GHSA-8988-4f7v-96qf) Build NOT run locally; lockfile-only. Verify in CI.
🔍 WordPress Plugin Check Report
📊 Report
❌ Errors (2)📁 lib/class-godam-frappe-dispatch-installer.php (2 errors)
|
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
missing_composer_json_file | The "/vendor" directory using composer exists, but "composer.json" file is missing. |
📁 readme.txt (2 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
mismatched_plugin_name | Plugin name "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" is different from the name declared in plugin header "GoDAM". |
0 |
trademarked_term | The plugin name includes a restricted term. Your chosen plugin name - "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" - contains the restricted term "wordpress" which cannot be used at all in your plugin name. |
📁 assets/build/blocks/godam-gallery-v2/render.php (2 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
15 |
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$inner_block_video_ids". |
23 |
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$inner_block_video_ids". |
📁 assets/build/css/main.css (1 warning)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedStylesScope | This style is being loaded in all contexts. |
📁 assets/src/libs/analytics.min.js (5 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedScriptsScope | This script is being loaded in all frontend contexts. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/2026/06/30/hello-world/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/sample-page/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/demo-attachment-post/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
📁 assets/build/js/main.min.js (5 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedScriptsScope | This script is being loaded in all frontend contexts. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/2026/06/30/hello-world/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/sample-page/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/demo-attachment-post/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check
dhruvikpatel18
approved these changes
Jul 1, 2026
|
@subodhr258 I've reviewed this PR and built it locally, build succeeded with the dependent version changes. Should we go ahead and merge this to main? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lockfile-focused security bumps addressing open Dependabot alerts for the npm ecosystem. All fixes stay within the same major version as installed (no breaking major bumps, no source edits). The repo uses
overridesto pin transitive security versions; vulnerable pins were advanced to patched same-major releases, andposthog-jswas bumped (per Dependabot PR #1961) to drop its vulnerable transitive dependencies.Fixes
Why
overridesblock; bumping the override values to patched same-major versions is the repo's established mechanism for transitive security control.posthog-js^1.282.0 -> ^1.386.8 (matching Dependabot PR chore(deps): bump protobufjs and posthog-js #1961) eliminates the vulnerable transitiveprotobufjsand the@opentelemetry/core2.x copies entirely.@babel/coreadded tooverridesso the nested dev-only @WordPress copies (7.25.7) dedupe to 7.29.6.How tested
Lockfile-only changes generated with
npm install/update --package-lock-only --ignore-scripts. The lockfile parses as valid JSON. Build/tests NOT run locally — please verify in CI.Residual risk / not applied
@opentelemetry/core@1.30.1remains (transitive of@sentry/nodeand the OTel 1.x instrumentation tree, which require ^1.x). The advisory patch is 2.8.0 — a major bump of that 1.x tree. Out of safe scope; flagged for manual review.Do not merge without CI verification.