Skip to content

chore(deps): update transient devDependencies of markdown-link-check#1752

Merged
mschile merged 2 commits into
cypress-io:masterfrom
MikeMcC399:audit-fix
May 7, 2026
Merged

chore(deps): update transient devDependencies of markdown-link-check#1752
mschile merged 2 commits into
cypress-io:masterfrom
MikeMcC399:audit-fix

Conversation

@MikeMcC399
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 commented May 7, 2026

Situation

npm audit reports 2 vulnerabilities (1 moderate, 1 high) in transient dependencies of markdown-link-check@3.14.2 (current latest) defined in devDependencies:

# npm audit report

basic-ftp  <=5.3.0
Severity: high
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering - https://github.com/advisories/GHSA-rpmf-866q-6p89
fix available via `npm audit fix`
node_modules/basic-ftp

ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/ip-address

2 vulnerabilities (1 moderate, 1 high)

To address all issues, run:
  npm audit fix

Change

Execute npm audit fix to remediate the vulnerabilities.


Note

Low Risk
Low risk lockfile-only change updating transitive dev-only packages to remediate reported vulnerabilities; minimal runtime impact unless tooling relies on specific patched behavior.

Overview
Updates package-lock.json to bump transitive dependencies pulled in by markdown-link-check, upgrading basic-ftp to 5.3.1 and ip-address to 10.2.0 to address npm audit vulnerabilities.

Reviewed by Cursor Bugbot for commit 8c99280. Bugbot is set up for automated code reviews on this repo. Configure here.

Update
basic-ftp to 5.3.1
ip-address to 10.2.0
@cypress-app-bot
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 added bug Something isn't working tests labels May 7, 2026
@MikeMcC399 MikeMcC399 self-assigned this May 7, 2026
@MikeMcC399 MikeMcC399 marked this pull request as ready for review May 7, 2026 07:51
@MikeMcC399 MikeMcC399 requested a review from mschile May 7, 2026 07:51
@MikeMcC399
Copy link
Copy Markdown
Collaborator Author

MikeMcC399 commented May 7, 2026

I don't know why the "Add issue/PR to Triage Board" workflow has suddenly started failing. It doesn't have anything to do with the PR contents though.

I pushed an empty [run ci] commit to get rid of this error.

@mschile mschile merged commit 4e21bb3 into cypress-io:master May 7, 2026
87 checks passed
@MikeMcC399 MikeMcC399 deleted the audit-fix branch May 7, 2026 14:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants