Found too many vulnerabilities in `pnpm audit`
Open
@michelengelen is already working on this.
Since Jun 9, 2026.
scope: code-infra
- Dominant language
- JavaScript
- Stars
- 99.1k
- Forks
- 32.5k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 106
Description
Steps to reproduce
Steps:
- Run
pnpm audit - 53 vulnerabilities found
Severity: 2 low | 17 moderate | 31 high | 3 critical
Current behavior
There is a Renovate bot regularly checking the updates to the dependencies, but more and more high-severity vulnerabilities found.
Expected behavior
Please document the dependency update policy if there's one, and try to remedy as many as possible, at least for high and critical ones.
Context
I'm working on a fork to the material-ui and releasing my own version.
Your environment
npx @mui/envinfo
System:
OS: Linux 6.6 Ubuntu 24.04.4 LTS 24.04.4 LTS (Noble Numbat)
Binaries:
Node: 24.15.0 - /home/kiddliu/.nvm/versions/node/v24.15.0/bin/node
npm: 11.13.0 - /home/kiddliu/.nvm/versions/node/v24.15.0/bin/npm
pnpm: 10.33.4 - /home/kiddliu/.nvm/versions/node/v24.15.0/bin/pnpm
Browsers:
Chrome: Not Found
Firefox: Not Found
npmPackages:
@mui/internal-babel-plugin-minify-errors: 2.0.8-canary.27 => 2.0.8-canary.27
@mui/internal-bundle-size-checker: 1.0.9-canary.78 => 1.0.9-canary.78
@mui/internal-code-infra: 0.0.4-canary.50 => 0.0.4-canary.50
@mui/internal-docs-utils: workspace:^ => 3.0.4
@mui/internal-netlify-cache: 0.0.3-canary.5 => 0.0.3-canary.5
@mui/internal-scripts: workspace:^ => 3.0.7
@mui/internal-test-utils: 2.0.18-canary.22 => 2.0.18-canary.22
@mui/material: workspace:^ => 9.0.1
@mui/utils: workspace:^ => 9.0.1
@pigment-css/react: 0.0.30 => 0.0.30
@types/react: 19.2.14 => 19.2.14
react: 19.2.6 => 19.2.6
react-dom: 19.2.6 => 19.2.6
typescript: 6.0.3 => 6.0.3
Search keywords: audit vulnerabilities
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.