Skip to content

deendabot fixes #6267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
akshaydeo merged 2 commits into from
Aug 19, 2026
+5 −4
Merged

deendabot fixes #6267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc35bb3
deendabot fixes
akshaydeo Aug 18, 2026
63e558e
Merge branch 'dev' into 08-18-deendabot_fixes
akshaydeo Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/tools/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion .github/workflows/tools/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
"version": "0.0.0",
"private": true,
"description": "Pinned CI-only CLI tooling (newman). Not published, not part of the product build. Installed with `npm ci` so package-lock.json's integrity hashes are enforced, which is what OpenSSF Scorecard's Pinned-Dependencies check requires; a bare `npm install -g newman@x` pins the version but verifies nothing.",
"overridesRationale": "newman pins vulnerable transitive deps (handlebars, lodash, node-forge, flatted, underscore, qs, jose, uuid). Upstream has not released a newman that picks up the patched versions, so each one is forced to its fixed release here. Every consumer of these packages in the tree was checked for API compatibility, and `newman run` with the cli + htmlextra reporters was exercised against the forced tree. Drop an entry once newman ships a release that resolves at or above it.",
"dependencies": {
"newman": "6.2.2",
"newman-reporter-htmlextra": "1.23.1"
Expand All @@ -14,7 +15,7 @@
"flatted": "3.4.4",
"underscore": "1.13.8",
"qs": "6.15.3",
"jose": "4.15.5",
"jose": "4.15.9",
"uuid": "11.1.1"
}
}
Loading