Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade mocha peer-dependecy to fix cross-site Scripting (XSS) in serialize-javascript #4382

Open
alexkiro opened this issue Feb 17, 2025 · 1 comment

Comments

@alexkiro
Copy link

There is an XSS in the peer-dependecy chain (details here GHSA-76p7-773f-r4q5). I believe this is solvable by upgrading mocha to 10.6.0 or later. As mocha has already updated their dependecies in mochajs/mocha#5153

Latest 10.* version if 10.8.2. Latest version ATM 11.1.0 does not appear to be backwards compatible


Temporary solution is to override the peer dependency in your package.json file:

  "overrides": {
    "mocha": "10.8.2"
  }
@reallymello
Copy link
Contributor

I've submitted PR #4385 to address this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants