Skip to content

Security Audit Fix#9166

Open
danrossi wants to merge 8 commits intovideojs:mainfrom
danrossi:audit-fix
Open

Security Audit Fix#9166
danrossi wants to merge 8 commits intovideojs:mainfrom
danrossi:audit-fix

Conversation

@danrossi
Copy link
Copy Markdown

@danrossi danrossi commented Apr 3, 2026

Description

There was security audit errors that were critical related to installing a vulnerable Axios package via the access-sniff package. The browserify package security issue is low but unfixable and won't override the set packages. It is needed only for a test file so should be removed maybe.

There is alot of deprecated warnings that may be hard to fix. "videojs-standard" uses an old eslint which has an api change in 8.0.0.

Specific Changes proposed

This updates packages with overrides to fix the security audit issues

The access-sniff accessibility test has been changed to a pa11y accessibility test report. So that old outdated package can be removed. Some overrides wouldn't fix it's problem so safe to remove.

danrossi added 8 commits April 2, 2026 23:01
- move to pa11y for accessibility tester
- elliptic 6.6.1 is still vulnerable. So browserify package is vulnerable with no fix.
@danrossi
Copy link
Copy Markdown
Author

danrossi commented Apr 4, 2026

I cleaned up the overrides better. However there is no fix for browserify because the elliptic package is still vulnerable. If browserify is just used for a test file it might be safe to remove for now.

elliptic  *
Elliptic Uses a Cryptographic Primitive with a Risky Implementation - https://github.com/advisories/GHSA-848j-6mx2-7j84
fix available via `npm audit fix`
node_modules/elliptic
  browserify-sign  >=2.4.0
  Depends on vulnerable versions of elliptic
  node_modules/browserify-sign
    crypto-browserify  >=3.4.0
    Depends on vulnerable versions of browserify-sign
    Depends on vulnerable versions of create-ecdh
    node_modules/crypto-browserify
      browserify
      Depends on vulnerable versions of crypto-browserify
      node_modules/browserify
  create-ecdh  *
  Depends on vulnerable versions of elliptic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant