dineeek / ngx-libs-workspace / 25599032309

97%

push

github

fix: resolve 15 Dependabot alerts and CodeQL clear-text password log (#69)

* fix(playground-e2e): redact password from login command log

Resolves CodeQL js/clear-text-logging alert. The Cypress login stub
was logging the password argument to the console. Drop it from the
log statement and rename the parameter to mark it intentionally
unused.

* fix(deps): bump axios, fast-uri, hono, ip-address via pnpm overrides

Closes 15 open Dependabot alerts:
- axios bumped to 1.16.0 (covers 8 advisories incl. GHSA-pf86-5x62-jrwf,
  GHSA-3w6x-2g7m-8v23 prototype pollution, header injection)
- fast-uri bumped to 3.1.2 (host confusion + path traversal)
- hono bumped to 4.12.18 (CSS injection, JWT validation, cache leakage,
  JSX HTML injection)
- ip-address bumped to 10.2.0 (XSS in Address6)

630 of 668 branches covered (94.31%)

Branch coverage included in aggregate %.

785 of 791 relevant lines covered (99.24%)

96.82 hits per line