[Snyk] Upgrade @ckeditor/ckeditor5-alignment from 43.0.0 to 43.3.1#2
[Snyk] Upgrade @ckeditor/ckeditor5-alignment from 43.0.0 to 43.3.1#2niko-hoogeveen wants to merge 1 commit intomainfrom
Conversation
Snyk has created this PR to upgrade @ckeditor/ckeditor5-alignment from 43.0.0 to 43.3.1. See this package in npm: @ckeditor/ckeditor5-alignment See this project in Snyk: https://app.snyk.io/org/niko-hoogeveen/project/a3e06b05-1c12-4d03-8778-ca2c0f268590?utm_source=github&utm_medium=referral&page=upgrade-pr
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the final PR Bugbot will review for you during this billing cycle
Your free Bugbot reviews will reset on February 23
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| "types": "./build/ckeditor.d.ts", | ||
| "dependencies": { | ||
| "@ckeditor/ckeditor5-alignment": "^43.0.0", | ||
| "@ckeditor/ckeditor5-alignment": "^43.3.1", |
There was a problem hiding this comment.
Lock file not updated with package.json dependency change
High Severity
The package.json updates @ckeditor/ckeditor5-alignment to ^43.3.1, but the package-lock.json file was not updated and still references ^43.0.0. This mismatch means that when npm ci runs (common in CI/CD pipelines), the lock file takes precedence and the old vulnerable version will be installed. The security vulnerability (XSS in clipboard) that this PR aims to fix will not actually be remediated until the lock file is regenerated.
2 participants
Snyk has created this PR to upgrade @ckeditor/ckeditor5-alignment from 43.0.0 to 43.3.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 36 versions ahead of your current version.
The recommended version was released a year ago.
Issues fixed by the recommended upgrade:
SNYK-JS-CKEDITORCKEDITOR5CLIPBOARD-8097219
Release notes
Package name: @ckeditor/ckeditor5-alignment
-
43.3.1 - 2024-11-06
-
43.3.1-alpha.0 - 2024-11-06
-
43.3.0 - 2024-10-29
-
43.3.0-alpha.12 - 2024-10-29
-
43.3.0-alpha.11 - 2024-10-29
-
43.3.0-alpha.10 - 2024-10-28
-
43.3.0-alpha.9 - 2024-10-28
-
43.3.0-alpha.8 - 2024-10-28
-
43.3.0-alpha.7 - 2024-10-28
-
43.3.0-alpha.6 - 2024-10-28
-
43.3.0-alpha.5 - 2024-10-27
-
43.3.0-alpha.4 - 2024-10-26
-
43.3.0-alpha.3 - 2024-10-25
-
43.3.0-alpha.2 - 2024-10-25
-
43.3.0-alpha.1 - 2024-10-25
-
43.3.0-alpha.0 - 2024-10-24
-
43.2.0 - 2024-10-02
-
43.2.0-alpha.7 - 2024-10-02
-
43.2.0-alpha.6 - 2024-10-01
-
43.2.0-alpha.5 - 2024-09-30
-
43.2.0-alpha.4 - 2024-09-29
-
43.2.0-alpha.3 - 2024-09-28
-
43.2.0-alpha.2 - 2024-09-27
-
43.2.0-alpha.1 - 2024-09-26
-
43.2.0-alpha.0 - 2024-09-25
-
43.1.1 - 2024-09-25
-
43.1.0 - 2024-09-05
-
43.1.0-alpha.8 - 2024-09-05
-
43.1.0-alpha.7 - 2024-09-04
-
43.1.0-alpha.6 - 2024-09-03
-
43.1.0-alpha.5 - 2024-09-02
-
43.1.0-alpha.4 - 2024-09-01
-
43.1.0-alpha.3 - 2024-08-31
-
43.1.0-alpha.2 - 2024-08-30
-
43.1.0-alpha.1 - 2024-08-29
-
43.1.0-alpha.0 - 2024-08-28
-
43.0.0 - 2024-08-07
from @ckeditor/ckeditor5-alignment GitHub release notesImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Note
Dependency upgrade
public/h5p/h5plib/v127/joubel/editor/ckeditor5/package.json, update@ckeditor/ckeditor5-alignmentfrom^43.0.0to^43.3.1.Written by Cursor Bugbot for commit 68a1d60. This will update automatically on new commits. Configure here.