fix(deps): bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141#19842
fix(deps): bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141#19842
Conversation
Fixes Dependabot alert #1146. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is kicking off a free cloud agent to fix this issue. This run is complimentary, but you can enable autofix for all future PRs in the Cursor dashboard.
| integrity sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw== | ||
| version "3.4.2" | ||
| resolved "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz" | ||
| integrity sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA== |
There was a problem hiding this comment.
Lockfile references non-existent flatted version 3.4.2
High Severity
The lockfile pins flatted to version 3.4.2, but this version does not exist on npm — the latest published version is 3.4.1. The resolved URL and integrity hash are therefore invalid, which will cause yarn install to fail for any fresh install. The missing hash suffix in the resolved URL (compared to the previous entry and other registry.npmjs.org entries) also suggests this entry was manually edited rather than generated by yarn.
There was a problem hiding this comment.
Bugbot Autofix determined this is a false positive.
Version 3.4.2 exists on npm (published March 17, 2026), the integrity hash is valid, and yarn install completes successfully.
This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.
There was a problem hiding this comment.
lol bugbot correcting itself :D (pretty cool but what a waste of energy lol)
size-limit report 📦
|
node-overhead report 🧳Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
|


Fixes Dependabot alert #1146.