All alerts are transitive dev-scope deps, remediated via npm `overrides` in js/package.json. Verified: `npm install` clean, `gulp` build green, karma/jasmine suite 22/22 passing (postcss 7->8 and merge 1->2 are major bumps — build and tests confirmed unaffected). - js-yaml 3.14.2 -> 3.15.0 (#71, GHSA quadratic-complexity DoS, needs >= 3.15.0) - lodash 4.17.23 -> 4.18.1 (#62 code injection via _.template, #63 prototype pollution in _.unset/_.omit, needs >= 4.18.0) - merge 1.2.1 -> 2.1.1 (#14 prototype pollution, needs >= 2.1.1; major bump) - minimatch 3.0.4/3.1.2 -> 3.1.5 (#54 ReDoS in matchOne(), needs >= 3.1.3) - minimist (under optimist) 0.0.10 -> 0.2.4 (#30 critical + #9 prototype pollution, needs >= 0.2.4; per-parent override, root minimist already 1.2.8) - postcss 7.0.39 -> 8.5.16 (#66 XSS via unescaped </style>, #35 line-return parsing, needs >= 8.5.10; major bump, no 7.x patch exists) Note: `npm audit` still reports separate issues (brace-expansion, es5-ext, micromatch, socket.io-parser, ws) that are NOT in the Dependabot alert set; out of scope for this change. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

Uh oh!

[API] 'exclude' parameter when getting all notes should be optional #35

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions