mongodb-js / devtools-shared / 25282540085

79%

main: 79%

Pull #725

github

chore(deps): bump eslint-plugin-jsx-a11y to ^6.7.0 to fix CVE-2025-27789

Bumps eslint-plugin-jsx-a11y from ^6.4.1 to ^6.7.0 in
configs/eslint-config-devtools. Version 6.7.0 switched the
aria-query dependency from 4.x to 5.x, which drops the
@babel/runtime-corejs3 transitive dependency that was
vulnerable to GHSA-968p-4wvh-cqc8 / CVE-2025-27789.

Changes in lockfile:
- eslint-plugin-jsx-a11y: 6.6.1 -> 6.10.2
- aria-query: 4.2.2 -> 5.3.2 (dropped @babel/runtime-corejs3 dep)
- @babel/runtime-corejs3: removed entirely

Closes Dependabot alert #63.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

1876 of 2655 branches covered (70.66%)

Branch coverage included in aggregate %.

4055 of 4889 relevant lines covered (82.94%)

614.31 hits per line