As part of a routine, org-wide review of open dependency security advisories, this repository was assessed for whether flagged packages are actually installed and reachable in the running application. This issue summarises the recommended dependency updates so they can be tracked and prioritised.
All 5 open alerts on this repo are npm development-scope build tooling (transitive deps in package-lock.json). There are no composer advisories and no npm runtime-scope alerts. None of these represent a realistic production risk — this is routine toolchain hygiene.
Dependabot
There are currently no open Dependabot PRs on this repo. If Dependabot security updates aren't enabled, turning them on would automate routine bumps and surface future advisories as PRs.
npm build-tooling advisories (routine hygiene, not production)
The 5 alerts are all transitive build-toolchain dependencies (glob-matching / shell-quoting helpers typical of a webpack/gulp/eslint chain) that only execute during install/build on a developer machine or CI runner:
Recommended: run npm audit fix (or bump the top-level devDependency that pulls each in), regenerate package-lock.json, and re-run the build to confirm asset compilation still succeeds.
Full assessment and code-path validation (internal, private): silverstripeltd/advisory-check#68 and reports/repos/mods.md.
As part of a routine, org-wide review of open dependency security advisories, this repository was assessed for whether flagged packages are actually installed and reachable in the running application. This issue summarises the recommended dependency updates so they can be tracked and prioritised.
All 5 open alerts on this repo are npm development-scope build tooling (transitive deps in
package-lock.json). There are no composer advisories and no npm runtime-scope alerts. None of these represent a realistic production risk — this is routine toolchain hygiene.Dependabot
There are currently no open Dependabot PRs on this repo. If Dependabot security updates aren't enabled, turning them on would automate routine bumps and surface future advisories as PRs.
npm build-tooling advisories (routine hygiene, not production)
The 5 alerts are all transitive build-toolchain dependencies (glob-matching / shell-quoting helpers typical of a webpack/gulp/eslint chain) that only execute during install/build on a developer machine or CI runner:
shell-quote— ≥1.8.4 (GHSA-w7jw-789q-3m8p / CVE-2026-9277, critical by score but not production-reachable)minimatch— ≥3.1.3 (CVE-2026-27903)braces— ≥3.0.3 (CVE-2024-4068)uuid— ≥11.1.1 (CVE-2026-41907)picomatch— ≥2.3.2 (CVE-2026-33672)Recommended: run
npm audit fix(or bump the top-level devDependency that pulls each in), regeneratepackage-lock.json, and re-run the build to confirm asset compilation still succeeds.Full assessment and code-path validation (internal, private): silverstripeltd/advisory-check#68 and
reports/repos/mods.md.