Security Dependency Audit — March 2026
Overview
Resolved multiple high-severity Dependabot security alerts related to transitive dependencies (minimatch, ajv) and verified mitigation for a known Quill XSS vulnerability.
Alerts Resolved
minimatch — ReDoS Vulnerabilities (High Severity)
Alerts: #22–31
Three separate ReDoS (Regular Expression Denial of Service) advisories affected all installed versions of minimatch:
| Advisory | Description |
|---|---|
| GHSA-3ppc-4f35-3m26 | ReDoS via repeated wildcards with non-matching literal in pattern |
| GHSA-7r86-cg39-jmmj | matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| GHSA-23c5-xmqv-rm74 | Nested *() extglobs generate catastrophically backtracking regular expressions |
Versions before fix:
| Version | Consumed By |
|---|---|
| 3.1.2 | eslint, @eslint/eslintrc, eslint-plugin-import, eslint-plugin-jsx-a11y, eslint-plugin-react, multimatch |
| 7.4.6 | depcheck |
| 9.0.5 | @typescript-eslint/typescript-estree |
Fix applied: npm audit fix
| Before | After |
|---|---|
| 3.1.2 | 3.1.5 |
| 7.4.6 | 7.4.9 |
| 9.0.5 | 9.0.9 |
All three versions are now patched. No overrides field was needed — the semver ranges allowed in-place upgrades.
ajv — ReDoS with $data Option (Moderate Severity)
Alerts: #20–21
Version: 6.12.6 (transitive, via eslint + @eslint/eslintrc)
Resolved as part of the npm audit fix run. ajv 6.12.6 is the final patched release of the 6.x line and is intentionally pinned by ESLint's dependencies. Upgrading to ajv v8 is not possible without breaking eslint internals (different API and JSON Schema draft support).
Alert Mitigated (No Upstream Fix)
Quill — XSS via HTML Export (Low Severity)
Alerts: #12, #16 Advisory: GHSA-v3m3-f69x-jf25
Version: 2.0.3 (direct dependency) — latest stable release; no patched version available.
The vulnerability affects Quill's HTML export feature (root.innerHTML / getSemanticHTML()). An attacker could inject malicious content that persists when the HTML is rendered.
Mitigation Status: PROTECTED
A thorough audit of all code paths confirmed that Quill HTML output is always sanitized before rendering:
Sanitization components used:
| Component | Library | Allowed Tags |
|---|---|---|
SafeHtml.tsx | Custom DOM walker | p, h1-h4, ul, ol, li, strong, em, b, i, br, a |
SafeHtmlViewer.tsx | sanitize-html (npm) | b, i, em, strong, a, p, ul, ol, li, h1-3, br, span |
Verified rendering paths (all protected):
| Location | Sanitizer |
|---|---|
app/(visitor)/jobs/[jobId]/page.tsx | SafeHtml |
app/company/jobs/[jobId]/page.tsx | SafeHtml |
app/jobseeker/jobs/[jobId]/page.tsx | SafeHtml |
app/company/jobs/updatejob/[id]/summary.tsx | SafeHtmlViewer |
components/reusable/jobs/summary.tsx | SafeHtmlViewer |
components/buzzfeed/EventModal.tsx | SafeHtmlViewer |
No unprotected rendering paths were found. All dangerouslySetInnerHTML usages in the codebase were verified to either use sanitized content or non-user-controlled data (JSON-LD, CSS layouts).
Action Required
Monitor the quill GitHub repository for a 2.0.4+ release that addresses GHSA-v3m3-f69x-jf25. Once available, update the dependency:
npm install quill@latest
Build Verification
Production build passes cleanly after all dependency updates. The only pre-existing warning is the PipelineItemFields fragment duplication (unrelated to this change).
Files Changed
package-lock.json— Updated transitive dependency versions vianpm audit fix