Skip to content

Bump flatted from 3.3.3 to 3.4.4 - #280

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/flatted-3.4.2
Closed

Bump flatted from 3.3.3 to 3.4.4#280
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/flatted-3.4.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 21, 2026

Copy link
Copy Markdown
Contributor

Bumps flatted from 3.3.3 to 3.4.4.

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 21, 2026
@dependabot
dependabot Bot requested review from a team as code owners March 21, 2026 10:28
@dependabot
dependabot Bot requested a review from a team March 21, 2026 10:28
@dependabot
dependabot Bot requested review from a team as code owners March 21, 2026 10:28
@marioviana

Copy link
Copy Markdown

Dependabot Review — flatted 3.3.x → 3.4.2

Risk level: 🟠 Variable (transitive dependency — prototype pollution fix)

Security fix (3.4.2):

  • CWE-1321 — Prototype pollution fix (__proto__ handling during deserialization)

(Flatted is commonly a transitive dep of winston or similar logging libraries. Prototype pollution here could be exploitable if attacker-controlled data is parsed through flatted.parse().)

CI: ✅ All checks passed
Mergeable: ✅ No conflicts

Safe to merge — security fix for a transitive dep, CI is green.

@risantos

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot dependabot Bot changed the title Bump flatted from 3.3.3 to 3.4.2 Bump flatted from 3.3.3 to 3.4.4 Aug 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/flatted-3.4.2 branch from 9eb704a to e04f16e Compare August 24, 2026 13:27
@risantos

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.4.
- [Commits](WebReflection/flatted@v3.3.3...v3.4.4)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/flatted-3.4.2 branch from e04f16e to 4c1d860 Compare August 24, 2026 14:29
@risantos

Copy link
Copy Markdown
Member

Addressed on #277

@risantos

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like flatted is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/flatted-3.4.2 branch August 24, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants