Skip to content

fix(deps): bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141 #19842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chargome merged 1 commit into from
Mar 18, 2026
Merged

fix(deps): bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141 #19842

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17561,9 +17561,9 @@ flat@^5.0.2:
integrity sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==

flatted@^3.1.0:
version "3.3.1"
resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.1.tgz#21db470729a6734d4997002f439cb308987f567a"
integrity sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==
version "3.4.2"
resolved "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz"
integrity sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==
Copy link

@cursor cursor bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile references non-existent flatted version 3.4.2

High Severity

The lockfile pins flatted to version 3.4.2, but this version does not exist on npm — the latest published version is 3.4.1. The resolved URL and integrity hash are therefore invalid, which will cause yarn install to fail for any fresh install. The missing hash suffix in the resolved URL (compared to the previous entry and other registry.npmjs.org entries) also suggests this entry was manually edited rather than generated by yarn.

Fix in Cursor Fix in Web

Copy link

@cursor cursor bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bugbot Autofix determined this is a false positive.

Version 3.4.2 exists on npm (published March 17, 2026), the integrity hash is valid, and yarn install completes successfully.

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.

Copy link
Member Author

@chargome chargome Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

well done

Copy link
Member

@Lms24 Lms24 Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lol bugbot correcting itself :D (pretty cool but what a waste of energy lol)


fn.name@1.x.x:
version "1.1.0"
Expand Down
Loading