Skip to content

Conversation

@kihonq
Copy link

@kihonq kihonq commented Aug 6, 2025

PR Checklist

Please check if your PR fulfills the following requirements:

  • The commit message follows our guidelines
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Adding Tests
  • Build related changes
  • CI related changes
  • Documentation changes
  • Other... Please describe:

What is the current behavior?

The current v6.6.0 release has two security vulnerabilities:

  1. Critical: [email protected] - SNYK-JS-FORMDATA-10841150 (Predictable Value Range)
  2. High: [email protected] - SNYK-JS-NJWT-6861582 (Prototype Pollution)

Issue Number: N/A

What is the new behavior?

This PR upgrades the vulnerable dependencies to their secure versions:

  • form-data: 4.0.0 → 4.0.4 (patch upgrade, no breaking changes)
  • njwt: 1.0.0 → 2.0.1 (major upgrade, but API compatible)

All tests pass successfully after the upgrades.
image

Does this PR introduce a breaking change?

  • Yes
  • No

Other information

  • Security Impact: Resolves 2 critical security vulnerabilities
  • Testing: All unit tests and Jest tests pass successfully
  • Compatibility: Backward compatible with existing code
  • Dependencies: Only affects dev dependencies, no runtime API changes

Reviewers

@okta/okta-sdk-nodejs-maintainers

- Upgrade form-data from 4.0.0 to 4.0.4 to fix SNYK-JS-FORMDATA-10841150 (Critical)
- Upgrade njwt from 1.0.0 to 2.0.1 to fix SNYK-JS-NJWT-6861582 (High)
- Both upgrades are backward compatible with no breaking changes
- All tests pass successfully after upgrades
@kihonq kihonq changed the base branch from master to 6.6 August 6, 2025 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant