From f609e9f58f1d1d0bfce167c750f2a40dbf5155d5 Mon Sep 17 00:00:00 2001 From: Sunny Wu Date: Fri, 17 Jul 2026 11:42:09 +1000 Subject: [PATCH] fix(deps): bump websocket-driver to 0.7.5 (CVE-2026-54466) Add npm override forcing websocket-driver ^0.7.5 to remediate CVE-2026-54466 (CRITICAL) flagged by Trivy. websocket-driver is a dev-only transitive dependency (webpack-dev-server -> sockjs/ faye-websocket) and is not reachable in the static production build, but a clean patch-level fix is available so we upgrade rather than suppress. UID2-7491 Co-Authored-By: Claude Opus 4.8 Ticket: UID2-7491 Branch: syw-UID2-7491-websocket-driver-cve --- package-lock.json | 6 +++--- package.json | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 327486550..3f99fed18 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18731,9 +18731,9 @@ } }, "node_modules/websocket-driver": { - "version": "0.7.4", - "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz", - "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==", + "version": "0.7.5", + "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz", + "integrity": "sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==", "dependencies": { "http-parser-js": ">=0.5.1", "safe-buffer": ">=5.1.0", diff --git a/package.json b/package.json index 738570ac3..3d4f74732 100644 --- a/package.json +++ b/package.json @@ -65,7 +65,8 @@ "@babel/plugin-transform-modules-systemjs": ">=7.29.4", "fast-uri": ">=3.1.2", "shell-quote": "^1.8.4", - "ws": ">=7.5.11" + "ws": ">=7.5.11", + "websocket-driver": "^0.7.5" }, "browserslist": { "production": [