lock
lock copied to clipboard
security: Remove vulnerable node-es-module-loader dependency (SEC-2160)
Summary
This PR resolves the security vulnerability SEC-2160 by removing the vulnerable [email protected] dependency that was pulling in [email protected].
Changes Made
-
Removed vulnerable dependency: Removed
[email protected]from devDependencies -
Updated lang-audit script: Modified
scripts/lang-audit.jsto use native ES6 dynamic imports instead of the old module loader -
Leveraged existing infrastructure: The script already uses the
esmpackage, enabling nativeimport()calls
Security Impact
- ✅ Eliminates the operational risk from
[email protected] - ✅ Maintains all existing functionality
- ✅ All 68 test suites pass (401 tests total)
- ✅ The
i18n:validatescript continues to work correctly
Testing
- All existing tests pass
- The i18n validation script functions correctly with 100% coverage
- No breaking changes introduced
This fix completely resolves the Socket security alert for [email protected] while maintaining backward compatibility.