From 2b8ebc78824c7d9cf8bd70d7a5ec6314c46ef8a9 Mon Sep 17 00:00:00 2001 From: SergeantPanda Date: Sat, 14 Mar 2026 12:32:38 -0500 Subject: [PATCH] Security: Updated `flatted` to 3.4.1, resolving **high** unbounded recursion DoS in the `parse()` revive phase --- CHANGELOG.md | 5 +++++ frontend/package-lock.json | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b620941..03cef51f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,6 +56,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Removed a dead `onLogout` handler in `Sidebar` that called `logout()` and `window.location.reload()` but was never wired to any UI element. - EPG output when no `days` parameter is specified now excludes already-ended programs instead of returning all historical data. +### Security + +- Updated frontend npm dependencies to resolve 1 high-severity vulnerability: + - Updated `flatted` to 3.4.1, resolving **high** unbounded recursion DoS in the `parse()` revive phase ([GHSA-25h7-pfq9-p65f](https://github.com/advisories/GHSA-25h7-pfq9-p65f)) + ### Fixed - EPG programme parsing crash when an XMLTV source contains programme titles exceeding 255 characters. Previously, a single oversized title would cause the entire `bulk_create` batch to fail with a database truncation error, silently dropping all programmes in that batch. Titles are now truncated to 255 characters before being saved. (Fixes #1039) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 5ba9fec3..9a0adea6 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -3554,9 +3554,9 @@ } }, "node_modules/flatted": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz", - "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==", + "version": "3.4.1", + "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz", + "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==", "dev": true, "license": "ISC" },