Repository navigation
fix(security): auto audit fix - #1479
sendbird-sdk-deployment wants to merge 1 commit into
Conversation
|
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-111181 | body-parser |
1.20.8 |
1.20.9 |
| CVE-2024-21539 | @eslint/plugin-kit |
0.2.0 |
0.2.3 |
🟡 Medium · 1 finding
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-104844 | postcss-selector-parser |
6.1.5 |
7.1.6 |
🟢 Low · 2 findings
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2026-115897 | serialize-javascript |
6.0.2 |
7.1.3 |
| CVE-2026-115897 | serialize-javascript |
4.0.0 |
7.1.3 |
✅ Resolved · 3 findings
| CVE | Package | Version |
|---|---|---|
| CVE-2026-97058 | sprintf-js |
1.0.3 |
| CVE-2026-93687 | braces |
3.0.3 |
| CVE-2026-104844 | postcss-selector-parser |
6.1.4 |
View full analysis in Upwind Console
Scan completed in 35s
Scan history (1 scan)
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
ed6997a < |
2026-10-26 09:28 UTC | +5 | -3 | +2 |
Last scanned: ed6997a · 2026-10-26 09:28 UTC
|
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
ed6997a < |
2026-10-26 09:28 UTC | 0 | 0 | 0 |
Last scanned: ed6997a · 2026-10-26 09:28 UTC
✅ Deploy Preview for sendbird-uikit-react ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed6997aa7c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| version: 6.4.4 | ||
| resolution: "vite@npm:6.4.4" |
There was a problem hiding this comment.
When the root Vite dev server is exposed to a network and a sensitive file covered by server.fs.deny is also under server.fs.allow, version 6.4.4 permits the deny rule to be bypassed with crafted query strings. This change specifically introduces that affected release; GHSA-8g5g-mxqh-grgj identifies 6.4.5 as the fixed v6 version, which the sample locks already use, so the root lock should resolve 6.4.5 as well.
Useful? React with 👍 / 👎.
Security Audit Report
Repository:
sendbird/sendbird-uikit-reactTargets:
samples/groupchannel(npm),samples/openchannel(npm),samples/router(npm),samples/typescript_sample(npm),.(yarn-berry)Date: 2026-10-26
Summary
Fixed Vulnerabilities
fs.existsSync()existence check can be bypassed on Windowsserver.fs.allowcould be served when project paths match system paths on non-Windows machineRemaining Vulnerabilities (requires manual review)
dirparameterfromis unset{a},b}rewrite causes CPU denial of serviceChanged files
samples/groupchannel/package-lock.json, samples/openchannel/package-lock.json, samples/router/package-lock.json, samples/typescript_sample/package-lock.json, yarn.lockReview checklist