Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix socket security vulnerabilities #467

Closed
5 tasks
georgewrmarshall opened this issue Mar 6, 2025 · 0 comments · Fixed by #468
Closed
5 tasks

Fix socket security vulnerabilities #467

georgewrmarshall opened this issue Mar 6, 2025 · 0 comments · Fixed by #468
Assignees

Comments

@georgewrmarshall
Copy link
Contributor

Description

Review and clean up Socket Security registry resolutions in package.json. We need to verify which security-related package resolutions are actually needed in our dependency tree and remove any unnecessary ones to maintain a clean dependency structure.

Technical Details

Current Socket Security registry resolutions that need to be reviewed:

  • function.prototype.name
  • array.prototype.map
  • string.prototype.matchall
  • json-stable-stringify
  • regexp.prototype.flags
  • typedarray.prototype.slice
  • is-weakref
  • is-boolean-object

Steps needed:

  1. Check each package's usage in the dependency tree using yarn why
  2. Verify if the Socket Security registry version is needed for each package
  3. Remove any resolutions for packages that aren't in our dependency tree
  4. Document which packages require the security fixes and why

Acceptance Criteria

  • Each Socket Security registry resolution in package.json is verified as necessary
  • Unnecessary resolutions are removed
  • Dependencies still resolve correctly after changes (yarn install works)
  • Security scan passes without new vulnerabilities
  • Documentation added for why each remaining Socket Security resolution is needed

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant