[Security] HIGH: 9 critical/high dependency vulns #27

New issue

Closed

opened 2026-05-16 02:07:09 +00:00 by Mark · 0 comments

Mark commented

2026-05-16 02:07:09 +00:00

Owner

Verification

eslint-config-next and @next/eslint-plugin-next are both resolved to 15.5.18 in package-lock.json — past the vulnerable range (14.0.5-canary.0 - 15.0.0-rc.1).

npm ls eslint-config-next @next/eslint-plugin-next next
├── eslint-config-next@15.5.18
│   └── @next/eslint-plugin-next@15.5.18
└── next@15.5.18

npm audit confirms zero high/critical vulns from these packages.

Remaining high vulns (fast-xml-parser, flatted, minimatch, picomatch, fast-xml-builder) are from other dependency chains (AWS SDK, ESLint core, tailwindcss) and are tracked separately.

Closes #27 via SLICE S01.

## Verification eslint-config-next and @next/eslint-plugin-next are both resolved to **15.5.18** in package-lock.json — past the vulnerable range (14.0.5-canary.0 - 15.0.0-rc.1). ``` npm ls eslint-config-next @next/eslint-plugin-next next ├── eslint-config-next@15.5.18 │ └── @next/eslint-plugin-next@15.5.18 └── next@15.5.18 ``` npm audit confirms **zero high/critical vulns from these packages**. Remaining high vulns (fast-xml-parser, flatted, minimatch, picomatch, fast-xml-builder) are from other dependency chains (AWS SDK, ESLint core, tailwindcss) and are tracked separately. Closes #27 via SLICE S01.