Skip to content

[SCF-2416] Upgrade vulnerable dependencies in ember-bootstrap - #5

Open
Joeu wants to merge 1 commit into
gaurav/chore/SCF-2415-part-9-refresh-remaining-depsfrom
joeu/feat/scf-2416-upgrade-babel-runtime
Open

Joeu wants to merge 1 commit into
gaurav/chore/SCF-2415-part-9-refresh-remaining-depsfrom
joeu/feat/scf-2416-upgrade-babel-runtime

Conversation

@Joeu

@Joeu Joeu commented Oct 28, 2026 •

Copy link
Copy Markdown

Summary

  • Add a yarn resolution pinning @babel/runtime to ^7.29.7. ember-cli-babel@7.26.11 pins it to exactly 7.12.18, which is affected by CVE-2025-27789 (fixed in 7.26.10).
  • yarn.lock now has a single @babel/runtime@7.29.10 entry.

Testing

  • yarn lint (0 errors), yarn build, yarn nodetest and yarn test:ember pass.

🤖 Generated with Claude Code

@Gaurav0 Gaurav0 left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. Needs to be recreated on top of SCF-2415
  2. Still has lots of moderate vulnerabilities (see yarn audit)
  3. @babel/runtime 7.12.18 is still pulled into partners because it is a transitive of a dependency, not a devDependency, this solves nothing.

ember-cli-babel@7.26.11 pins @babel/runtime to exactly 7.12.18, which is
affected by CVE-2025-27789 (fixed in 7.26.10). A yarn resolution collapses
the lockfile to a single 7.29.10 entry.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Joeu
Joeu changed the base branch from scf_master to gaurav/chore/SCF-2415-part-1-drop-node-16 October 29, 2026 16:29
@Joeu
Joeu force-pushed the joeu/feat/scf-2416-upgrade-babel-runtime branch from 917f1cd to bf62a87 Compare October 29, 2026 16:30
@Joeu
Joeu changed the base branch from gaurav/chore/SCF-2415-part-1-drop-node-16 to gaurav/chore/SCF-2415-part-9-refresh-remaining-deps October 29, 2026 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants