[Task](juno): Fix high and medium vulnerabilities #1436

Activity

1. guoda-puidokaite

   added the

   Task

   issue type on Feb 2, 2026
2. github-project-automation

   added this to Juno Roadmapon Feb 2, 2026
3. guoda-puidokaite

   self-assigned this

   on Feb 2, 2026
4. github-project-automation

   moved this to New in Juno Roadmapon Feb 2, 2026
5. guoda-puidokaite

   moved this from New to In progress in Juno Roadmapon Feb 18, 2026
6. guoda-puidokaite commented on Feb 18, 2026

   

   guoda-puidokaite

   on Feb 18, 2026

   Last edited by guoda-puidokaite

   ContributorAuthor

   More actions

   Update

   license-checker-rseidelsohn: 4.4.2 introduces a high severity vulnerability (command injection) through glob: 10.4.5, a transitive dependency.

   Problem:

   • Can’t upgrade license-checker-rseidelsohn as we're using the latest version.
   • glob isn't a direct dependency of license-checker-rseidelsohn. license-checker-rseidelsohn uses read-installed-packages uses read-package-json which uses glob. We can't override the version of any in-between dependencies, as the latest versions currently still contain the problematic version of glob.
   • Last license-checker-rseidelsohn: 4.4.2 was a year ago. It doesn't seem to be maintained often e.g. from comments in the library. It also uses deprecated read-package-json: 6.0.4.

   Solutions

   Overriding (Proposed in last maintenance meeting)

   • We can override the version of glob in package.json.
   • However, this can only be done globally in package.json (without manual lock file manipulation).
   • Since it's used by a few other libraries too, if this is an acceptable solution, we need to assess which version we could override to and the compatibility/risk of this. However, this doesn't seem like a stable long-term solution., keeping in mind that license-checker-rseidelsohn isn't maintained often.

   LATEST UPDATE: It's possible to pnpm override a specific one with e.g. eslint-plugin-react>minimatch.

   Otherwise,

   • request an update to the library(ies)
   • find a manual solution
     • forking
     • our own solution for lisence checking
     • etc.
7. guoda-puidokaite

   linked a pull request that will close this issuechore(deps): remove license-checker-rseidelsohn and replace with GH action #1488on Feb 26, 2026
8. guoda-puidokaite commented on Mar 4, 2026

   

   guoda-puidokaite

   on Mar 4, 2026

   Last edited by guoda-puidokaite

   ContributorAuthor

   More actions

   (Update)

   Removal of license-checker-rseidelsohn

   We decided to remove license-checker-rseidelsohn, as it's not maintained. This package was used to check whether the npm dependencies included in our project match an approved list of licenses. Separate ticket #1502 raised.

   Other High Vulnerabilities

   Monitoring other high vulnerabilities after:

   • chore(deps): add pnpm override to remove minimatch@3.1.5 from lock file #1507
   • chore(deps): upgrade eslint to v10 to fix minimatch ReDoS vulnerability #1495
   • Recent Dependabot dependency upgrades.

   

   Ticket will stretch to the next sprint.
9. guoda-puidokaite

   linked a pull request that will close this issuechore(deps): upgrade eslint to v10 to fix minimatch ReDoS vulnerability #1495on Mar 6, 2026
10. guoda-puidokaite

    linked a pull request that will close this issuechore(deps): add pnpm override to remove minimatch@3.1.5 from lock file #1507on Mar 6, 2026
11. guoda-puidokaite

    moved this from In progress to Done in Juno Roadmapon Mar 11, 2026
12. guoda-puidokaite

    closed this as completedby moving to Done in Juno Roadmapon Mar 11, 2026
13. guoda-puidokaite commented on Mar 11, 2026

    

    guoda-puidokaite

    on Mar 11, 2026

    ContributorAuthor

    More actions

    All resolved!
14. guoda-puidokaite

    linked a pull request that will close this issuechore(deps): globally override minimatch to >=10.2.4 #1514on Mar 11, 2026