Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
In #3467599: Update NPM packages flagged by yarn audit we discovered some of our NPM packages are being flagged by yarn audit for having CVEs.
We fixed the 11.x and 11.0.x branches in that issue.
branches below have a different yarn version/lock file format so let's to that in a different issue if necessary and leave this one here.
Thus spoketh @nod in 3467599-30
Although the security of Drupal itself isn't compromised:
Note also that this only affects development dependencies and can't be exploited at runtime, the Drupal Security Team will not be issuing a security release or advisory about this change.
Thus spoketh @longwave in 3467599-5
I think we still want to fix this in the active D10-branches as well, since a security scan might alert about these packages.
Steps to reproduce
yarn audit
Proposed resolution
Bump the versions of flagged NPM dependencies, where preferable by removing the entry for each of them in yarn.lock and doing a yarn install.
If that doesn't work, use resolutions
Remaining tasks
User interface changes
Introduced terminology
API changes
Data model changes
Release notes snippet
Issue fork drupal-3469840
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3469840-10.3.x
changes, plain diff MR !9313 - 3469840-update-npm-packages changes, plain diff MR !9311
Comments
Comment #3
spokjeFor
10.4.x:Comment #4
spokjeAfter the MR, we left with:
As said in #3467599-25: Update NPM packages flagged by yarn audit by me:
If not,
micromatchhasn't had a new release since May 2024, so there's no indication this will be fixed there soon.That would have been a reason to stall this issue until that would happen, but as said, I don't think it will in the foreseeable future.
So let's roll with what we got in here.
Comment #6
spokjeFor
10.3.x:Basically the same as #3469840-3: Update NPM packages flagged by yarn audit for 10.4.x and 10.3.x and #3469840-4: Update NPM packages flagged by yarn audit for 10.4.x and 10.3.x, diff from the
10.4.x-MR didn't apply cleanly, but otherwise we should be good with the code>10.3.x-MR.Comment #7
spokjeComment #8
spokjeComment #9
smustgrave commentedSince same changes were accepted for 11.x and 11.0.x sure these are fine.
Comment #14
nod_Committed 48b3765 and pushed to 10.4.x. Thanks!
Committed d69ed7d and pushed to 10.3.x. Thanks!