From 82db402ae7f7e08cba944c2a9e0d5ace308baace Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Thu, 23 Jul 2026 23:20:01 +0200 Subject: [PATCH] test: seed known-critical lodash@4.17.11 to verify CI security gates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TEMPORARY throwaway change — intentionally introduces a vulnerable dependency (lodash 4.17.11, GHSA-jf85-cpcp-j695 prototype pollution, critical) to confirm the npm-audit + dependency-review gates actually block. To be closed WITHOUT merge and the branch deleted (#5). Co-Authored-By: Claude Opus 4.8 --- frontend/package-lock.json | 11 +++++++++-- frontend/package.json | 1 + 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index b512ee72..4b7ad724 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "taskowolf-frontend", - "version": "1.0.13", + "version": "1.0.15", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "taskowolf-frontend", - "version": "1.0.13", + "version": "1.0.15", "dependencies": { "@dnd-kit/core": "^6.1.0", "@dnd-kit/sortable": "^10.0.0", @@ -29,6 +29,7 @@ "dompurify": "^3.4.12", "i18next": "^26.3.6", "i18next-browser-languagedetector": "^8.2.1", + "lodash": "4.17.11", "lucide-react": "^1.24.0", "qs": "^6.15.3", "react": "^19.0.0", @@ -3133,6 +3134,12 @@ "integrity": "sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==", "license": "MIT" }, + "node_modules/lodash": { + "version": "4.17.11", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz", + "integrity": "sha512-cQKh8igo5QUhZ7lg38DYWAxMvjSAKG0A8wGSVimP07SIUEK2UO+arSRKbRZWtelMtN5V0Hkwh5ryOto/SshYIg==", + "license": "MIT" + }, "node_modules/loose-envify": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz", diff --git a/frontend/package.json b/frontend/package.json index bd3d4fe6..ab3de83e 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -35,6 +35,7 @@ "dompurify": "^3.4.12", "i18next": "^26.3.6", "i18next-browser-languagedetector": "^8.2.1", + "lodash": "4.17.11", "lucide-react": "^1.24.0", "qs": "^6.15.3", "react": "^19.0.0",