[Snyk] Upgrade pdfmake from 0.2.16 to 0.2.20 #2070
Conversation
Snyk has created this PR to upgrade pdfmake from 0.2.16 to 0.2.20. See this package in yarn: pdfmake See this project in Snyk: https://app.snyk.io/org/cboard/project/d8988709-12b3-418a-b44c-fca27f9b400c?utm_source=github&utm_medium=referral&page=upgrade-pr
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "mongoose": "^8.19.2", | ||
| "ogv": "^1.8.9", | ||
| "pdfmake": "^0.2.15", | ||
| "pdfmake": "^0.2.20", |
There was a problem hiding this comment.
Dependency is bumped to pdfmake ^0.2.20 here, but package-lock.json still declares pdfmake ^0.2.15 and locks node_modules/pdfmake to 0.2.16 (e.g., lines 51 and 23073–23076). Any npm-based install/CI that honors the lockfile will therefore continue to pull 0.2.16, leaving the intended security upgrade unapplied except when using Yarn. Please update package-lock.json (or remove it) so npm installs pick up 0.2.20.
Useful? React with 👍 / 👎.
Snyk has created this PR to upgrade pdfmake from 0.2.16 to 0.2.20.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 4 versions ahead of your current version.
The recommended version was released 7 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-MONGOOSE-8623536
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: