{"id":"6a5676d9f78fad31cc0eb556","title":"2026 07 14 Issue 316","path":"how-to/committee/release-notes/2026-07-14-issue-316","contentMarkdown":"# 14-Jul-2026 — resolve open Dependabot vulnerability alerts [ref #316](https://github.com/nbarrett/ngx-ramblers/issues/316)\n\n## [build 776](https://github.com/nbarrett/ngx-ramblers/actions/runs/29354643657) — [commit c6f16c2](https://github.com/nbarrett/ngx-ramblers/commit/c6f16c2f0fc479a0bcc5d483f078b454adcdd6c3)\n\n_____\n\nClears all 14 open Dependabot alerts (3 high, 7 medium, 4 low) with four\ndependency changes, plus a fifth pre-emptive fix.\n\nThe direct nodemailer pin (9.0.3) was never vulnerable: all eight nodemailer\nalerts were against the stale 6.9.16 copy nested under mailparser 3.7.2.\nBumping mailparser drops that copy along with the vulnerable linkify-it, so a\nsingle bump clears ten alerts.\n\n- mailparser 3.7.2 -> 3.9.14 (clears the 8 nodemailer alerts, the mailparser\nXSS, and the linkify-it quadratic scan; nodemailer and linkify-it now resolve\nto single patched copies at 9.0.3 and 5.0.2)\n- morgan 1.10.1 -> 1.11.0 (log forging via control characters in :remote-user)\n- serialize-javascript override to 7.0.7 in server (high-severity RCE via\nRegExp.flags, plus CPU exhaustion DoS). An override is the only route: even\nmocha 11.7.6 still declares serialize-javascript@^6.0.2\n- @babel/core override to 7.29.7 at root, collapsing the 7.29.0 copy nested\nunder @angular/compiler-cli (dev only, arbitrary file read via\nsourceMappingURL)\n- uuid override to 11.1.1 in server. Not yet reported by Dependabot because it\narrives with exceljs (ref #315), which is not yet on origin/main. exceljs\n4.4.0 pins uuid ^8.3.0, which has a missing buffer bounds check in v3/v5/v6.\nNot reachable in practice (exceljs only calls v4, without a buffer), but it\nwould be raised as an alert as soon as #315 is pushed.\n\nnpm audit reports 0 vulnerabilities in both projects. Server typecheck clean,\n879 server unit tests passing, production Angular build succeeds, and exceljs\nxlsx write/read round-trips correctly against uuid 11.","contentHtml":"<h1>14-Jul-2026 — resolve open Dependabot vulnerability alerts <a href=\"https://github.com/nbarrett/ngx-ramblers/issues/316\">ref #316</a></h1>\n<h2><a href=\"https://github.com/nbarrett/ngx-ramblers/actions/runs/29354643657\">build 776</a> — <a href=\"https://github.com/nbarrett/ngx-ramblers/commit/c6f16c2f0fc479a0bcc5d483f078b454adcdd6c3\">commit c6f16c2</a></h2>\n<hr>\n<p>Clears all 14 open Dependabot alerts (3 high, 7 medium, 4 low) with four\ndependency changes, plus a fifth pre-emptive fix.</p>\n<p>The direct nodemailer pin (9.0.3) was never vulnerable: all eight nodemailer\nalerts were against the stale 6.9.16 copy nested under mailparser 3.7.2.\nBumping mailparser drops that copy along with the vulnerable linkify-it, so a\nsingle bump clears ten alerts.</p>\n<ul>\n<li>mailparser 3.7.2 -&gt; 3.9.14 (clears the 8 nodemailer alerts, the mailparser\nXSS, and the linkify-it quadratic scan; nodemailer and linkify-it now resolve\nto single patched copies at 9.0.3 and 5.0.2)</li>\n<li>morgan 1.10.1 -&gt; 1.11.0 (log forging via control characters in :remote-user)</li>\n<li>serialize-javascript override to 7.0.7 in server (high-severity RCE via\nRegExp.flags, plus CPU exhaustion DoS). An override is the only route: even\nmocha 11.7.6 still declares serialize-javascript@^6.0.2</li>\n<li>@babel/core override to 7.29.7 at root, collapsing the 7.29.0 copy nested\nunder @angular/compiler-cli (dev only, arbitrary file read via\nsourceMappingURL)</li>\n<li>uuid override to 11.1.1 in server. Not yet reported by Dependabot because it\narrives with exceljs (ref #315), which is not yet on origin/main. exceljs\n4.4.0 pins uuid ^8.3.0, which has a missing buffer bounds check in v3/v5/v6.\nNot reachable in practice (exceljs only calls v4, without a buffer), but it\nwould be raised as an alert as soon as #315 is pushed.</li>\n</ul>\n<p>npm audit reports 0 vulnerabilities in both projects. Server typecheck clean,\n879 server unit tests passing, production Angular build succeeds, and exceljs\nxlsx write/read round-trips correctly against uuid 11.</p>\n"}