Skip to content

security: Remove vulnerable node-es-module-loader dependency (SEC-2160) #2629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

harekrishnarai
Copy link

Summary

This PR resolves the security vulnerability SEC-2160 by removing the vulnerable [email protected] dependency that was pulling in [email protected].

Changes Made

  1. Removed vulnerable dependency: Removed [email protected] from devDependencies
  2. Updated lang-audit script: Modified scripts/lang-audit.js to use native ES6 dynamic imports instead of the old module loader
  3. Leveraged existing infrastructure: The script already uses the esm package, enabling native import() calls

Security Impact

  • ✅ Eliminates the operational risk from [email protected]
  • ✅ Maintains all existing functionality
  • ✅ All 68 test suites pass (401 tests total)
  • ✅ The i18n:validate script continues to work correctly

Testing

  • All existing tests pass
  • The i18n validation script functions correctly with 100% coverage
  • No breaking changes introduced

This fix completely resolves the Socket security alert for [email protected] while maintaining backward compatibility.

@harekrishnarai harekrishnarai requested a review from a team as a code owner June 11, 2025 08:47

Unverified

The email in this signature doesn’t match the committer email.
@harekrishnarai harekrishnarai force-pushed the chore/removed-node-es-module-loader-SEC-2160 branch from fdd1193 to 9e763d7 Compare June 11, 2025 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant