projectGenerator dependencies have newer releases #672

Activity

1. danoli3

   self-assigned this

   on Oct 22, 2026
2. danoli3 commented on Oct 22, 2026

   

   danoli3

   on Oct 22, 2026

   Last edited by danoli3

   Member

   More actions

   Updated in #673 (GUI 0.105.0). Security fixes picked up:

   jQuery 2.1.3 -> 3.7.1

   CVE	Fixed in	Issue
   CVE-2015-9251	3.0.0	cross-domain $.ajax responses with text/javascript executed without dataType (XSS)
   CVE-2019-11358	3.4.0	$.extend(true, {}, ...) prototype pollution via __proto__
   CVE-2020-11022	3.5.0	HTML passed to DOM manipulation methods (.html(), .append(), ...) could run untrusted code (XSS)
   CVE-2020-11023	3.5.0	same, for HTML containing <option> elements (XSS)

   Electron 43.5.0 -> 44.9.3 (Chromium 150.0.7871.250 -> 152.0.7977.167)

   • 831 Chromium CVEs from the Chrome 151 / 152 bulletins: 33 Critical, 232 High, 367 Medium, 199 Low, including CVE-2026-85046 (V8 type confusion, exploited in the wild). Full list: Update dependencies (#672): Electron 44, jQuery 3.7.1, Semantic UI 2.5.0, n-readlines 3, actions v7 / Node 24 #673 (comment)
   • Node 24.19.0 -> 24.22.0: no Node security releases in that range.

   No known CVEs in the other updates: Semantic UI 2.0.8 -> 2.5.0, n-readlines 1.0.3 -> 3.4.1, @types/jquery, and the GitHub Actions bumps (those move the action runtime from Node 20, which is end of life, to Node 24).

   jQuery is held at 3.x (4.0 removed APIs Semantic UI 2.x uses). Electron 45.0.0 was released after this check and is left for a follow-up.
3. danoli3

   added a commit that references this issue on Oct 22, 2026

   Update dependencies (#672): Electron 44.9.3, n-readlines 3.4.1, jQuer…

   ...

   9bfe7db
4. danoli3

   closed this as completedon Oct 25, 2026