diff options
| author | Nikhil Ashoka <a.nikhil@ibm.com> | 2026-08-17 18:39:41 +0300 |
|---|---|---|
| committer | Nikhil Ashoka <a.nikhil@ibm.com> | 2026-08-31 17:19:17 +0300 |
| commit | 1bb0ea03be00cd8df686771491f33d5b1b363298 (patch) | |
| tree | a0baabd70b68d704598c95d3513f59c74d0b09a6 | |
| parent | 5c139d53429a8309418a19f226d0c3d4c0c6b8be (diff) | |
| download | webui-vue-master.tar.xz | |
- Remove ^ from the two packages that allowed silent auto-updates
on every npm install, closing the door on ChainDrop-style npm
supply-chain attacks where a compromised higher patch/minor
version is pulled in without review:
- @typescript-eslint/eslint-plugin: ^8.55.0 → 8.56.1
- @typescript-eslint/parser: ^8.55.0 → 8.56.1
Change-Id: Ie8b3878ce2aeaee6a89ee9e4681a6088aa3de770
Signed-off-by: Nikhil Ashoka <a.nikhil@ibm.com>
| -rw-r--r-- | package-lock.json | 4 | ||||
| -rw-r--r-- | package.json | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/package-lock.json b/package-lock.json index 114ab0cef..6d239c151 100644 --- a/package-lock.json +++ b/package-lock.json @@ -32,8 +32,8 @@ "xterm-addon-fit": "0.5.0" }, "devDependencies": { - "@typescript-eslint/eslint-plugin": "^8.55.0", - "@typescript-eslint/parser": "^8.55.0", + "@typescript-eslint/eslint-plugin": "8.56.1", + "@typescript-eslint/parser": "8.56.1", "@vitejs/plugin-basic-ssl": "2.1.3", "@vitejs/plugin-vue": "5.2.4", "@vitest/coverage-v8": "3.2.4", diff --git a/package.json b/package.json index 7bcbd69de..3491e573c 100644 --- a/package.json +++ b/package.json @@ -48,8 +48,8 @@ "@vitejs/plugin-vue": "5.2.4", "@vitest/coverage-v8": "3.2.4", "@vitest/eslint-plugin": "1.1.43", - "@typescript-eslint/eslint-plugin": "^8.55.0", - "@typescript-eslint/parser": "^8.55.0", + "@typescript-eslint/eslint-plugin": "8.56.1", + "@typescript-eslint/parser": "8.56.1", "@vue/cli-plugin-babel": "5.0.8", "@vue/cli-plugin-eslint": "5.0.8", "@vue/cli-plugin-router": "5.0.8", |