fix(deps): override lodash and uuid under postman-collection #2

2026-10-16T21:03:37Z

KofTwentyTwo commented

2026-10-16 21:03:37 +00:00

(Migrated from github.com)

Fixes #3

Resolves the lodash (high/medium) and uuid (medium) Dependabot alerts. Both arrive via @stoplight/prism-cli -> postman-collection, a dev-only mock-server dependency, so they are forced with npm overrides (lodash ^4.18.1, uuid ^11.1.1; uuid 11 keeps the CommonJS v4 export postman-collection uses).

Not changed: @faker-js/faker 5.5.3 (pinned by postman-collection; 10.x has an incompatible API) and sprintf-js (no patched version). Both are dev-only and dismissed with reasons.

Verification: npm run build and npm test pass; postman-collection loads.

🤖 Generated with Claude Code

Fixes #3 Resolves the lodash (high/medium) and uuid (medium) Dependabot alerts. Both arrive via `@stoplight/prism-cli` -> `postman-collection`, a dev-only mock-server dependency, so they are forced with npm `overrides` (lodash ^4.18.1, uuid ^11.1.1; uuid 11 keeps the CommonJS `v4` export postman-collection uses). Not changed: `@faker-js/faker` 5.5.3 (pinned by postman-collection; 10.x has an incompatible API) and `sprintf-js` (no patched version). Both are dev-only and dismissed with reasons. Verification: `npm run build` and `npm test` pass; `postman-collection` loads. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-cli#2