chore(deps): resolve open Dependabot npm advisories#2027
Open
subodhr258 wants to merge 2 commits into
Open
Conversation
Bump vulnerable transitive/direct npm dependencies to their patched versions via package.json overrides (and the direct @babel/core dev dependency), regenerating package-lock.json. Resolves the open Dependabot alerts for: websocket-driver, adm-zip, protobufjs, form-data, ws, js-yaml, webpack-dev-server, http-proxy-middleware, dompurify, markdown-it, @opentelemetry/core, launch-editor and @babel/core. showdown (GHSA-rmmh-p597-ppvv) has no upstream fix yet and is left in place; it is a dev-only dependency of @wordpress/scripts (markdownlint) and is not shipped in the plugin bundle.
🔍 WordPress Plugin Check Report
📊 Report
|
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
missing_composer_json_file | The "/vendor" directory using composer exists, but "composer.json" file is missing. |
📁 readme.txt (2 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
mismatched_plugin_name | Plugin name "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" is different from the name declared in plugin header "GoDAM". |
0 |
trademarked_term | The plugin name includes a restricted term. Your chosen plugin name - "GoDAM - Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more" - contains the restricted term "wordpress" which cannot be used at all in your plugin name. |
📁 assets/build/blocks/godam-gallery-v2/render.php (2 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
15 |
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$inner_block_video_ids". |
23 |
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$inner_block_video_ids". |
📁 tests/bootstrap.php (1 warning)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
23 |
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound | Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "wp_strip_all_tags". |
📁 assets/build/css/main.css (1 warning)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedStylesScope | This style is being loaded in all contexts. |
📁 assets/src/libs/analytics.min.js (5 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedScriptsScope | This script is being loaded in all frontend contexts. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880 (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/2026/07/20/hello-world/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/sample-page/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/demo-attachment-post/ (with handle analytics-library) is loaded in the footer. Consider a defer or async script loading strategy instead. |
📁 assets/build/js/main.min.js (5 warnings)
| 📍 Line | 🔖 Check | 💬 Message |
|---|---|---|
0 |
EnqueuedScriptsScope | This script is being loaded in all frontend contexts. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880 (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/2026/07/20/hello-world/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/sample-page/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
0 |
NonBlockingScripts.NoStrategy | This script on http://localhost:8880/demo-attachment-post/ (with handle rtgodam-script) is loaded in the footer. Consider a defer or async script loading strategy instead. |
🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Resolves Dependabot npm security advisories by bumping vulnerable transitive packages via package.json overrides (plus a direct @babel/core devDependency bump), with no source code changes.
Changes:
- Bumped
@babel/coredevDependency to7.29.6 - Added/updated multiple
overridesentries to force patched versions for vulnerable transitive dependencies - Updated override rules for packages like
ws,websocket-driver,protobufjs,dompurify, and tooling dependencies
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address review feedback on the override selectors: - Move markdown-it under the @wordpress/scripts override block; it is dev-only (markdownlint-cli -> @wordpress/scripts) and does not belong in the global graph. - Convert the newly added global pins to range selectors (pkg@<fixed: fixed) so they only bump copies below the patched version and never clamp future higher majors, matching the existing ws@</js-yaml@< convention. - @opentelemetry/core stays a global (range) override on purpose: it is pulled by posthog-js (shipped runtime) as well as the dev-only sentry/lighthouse tree, so scoping it under @wordpress/scripts would leave the runtime copy unpatched. - @babel/core keeps its direct devDependency bump as the source of truth; its override becomes @babel/core@<7.29.6 so it only patches older transitive copies instead of duplicating the direct pin. Resolves to a byte-identical package-lock.json (same 2616-package graph); all Dependabot-flagged packages remain on their patched versions.
| "@xmldom/xmldom": "0.8.13", | ||
| "@babel/core@<7.29.6": "7.29.6", | ||
| "@babel/plugin-transform-modules-systemjs": "7.29.4", | ||
| "@opentelemetry/core@<2.8.0": "2.8.0", |
| "@xmldom/xmldom": "0.8.13", | ||
| "@babel/core@<7.29.6": "7.29.6", | ||
| "@babel/plugin-transform-modules-systemjs": "7.29.4", | ||
| "@opentelemetry/core@<2.8.0": "2.8.0", |
Comment on lines
+120
to
+121
| "js-yaml@<4.0.0": "3.15.0", | ||
| "js-yaml@>=4.0.0": "4.2.0", |
KMchaudhary
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resolves the open Dependabot npm advisories on
godam. All fixes are made throughpackage.jsonoverrides(plus one direct devDependency bump for@babel/core), thenpackage-lock.jsonis regenerated. No source code changes.Overrides use range selectors (
pkg@<patched) so they only bump copies that sit below the patched version and never clamp a future higher major; dev-only pins (e.g.markdown-it) are scoped under the@wordpress/scriptsblock, while pins that also reach shipped runtime code (@opentelemetry/coreviaposthog-js,dompurify,protobufjs) stay global so every copy is patched.Alerts resolved (21 of 22)
dompurify(shipped viaisomorphic-dompurify) andprotobufjs(shipped viaposthog-js) are the only bumps that touch runtime bundle code;markdown-itand@opentelemetry/core@1.30.1are dev-only tooling under@wordpress/scripts(markdownlint / lighthouse-sentry) and are not run by any project script or shipped.Not fixed (no upstream patch)
@wordpress/scripts(viamarkdownlint), not shipped in the plugin bundle.npm audit fix --forcewould pull@wordpress/blocks@15.24.0outside the pinned range, so it is left as-is until an upstream fix lands or@wordpress/scriptsdrops it.Automated checks (done)
npm installregenerates the lockfile cleanlynpm run build:prodcompiles all 25 bundles with no errorsnpm run test:unitpasses (21 tests)npm run lint:package-jsonpassesManual verification / QA steps
Only two bumps reach shipped runtime code, so QA effort focuses there. Build the plugin (
npm run build:prod) and activate it on a test site, then:<img src=x onerror=alert(1)>renders with theonerrorremoved) - sanitization must remain intact.No manual steps needed for the dev-only bumps (adm-zip, ws, js-yaml, webpack-dev-server, http-proxy-middleware, launch-editor, form-data, markdown-it, @opentelemetry/core, @babel/core, websocket-driver) - they are build/test tooling and are covered by the automated checks above.
Automation impact
None. No source or UI changes, no new test-ids or hooks affected.