fix(security): auto audit fix

[sendbird-sdk-deployment]

Security Audit Report

Repository: sendbird/sendbird-uikit-react
Package Manager: yarn-berry
Project: .
Date: 2026-08-11

Summary

	Critical	High	Moderate	Low	Total
Before	1	15	15	3	34
Fixed	0	2	0	0	2
Remaining	1	13	15	3	32

Fixed Vulnerabilities

Package	Severity	Detail
1124064	high	fast-uri vulnerable to host confusion via literal backslash authority delimiter
1130720	high	fast-uri vulnerable to host confusion via backslash authority introducer

Remaining Vulnerabilities (requires manual review)

Package	Severity	Detail
1098094	high	Uncontrolled resource consumption in braces
1098681	moderate	Regular Expression Denial of Service (ReDoS) in micromatch
1100564	low	Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
1106734	low	@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
1109537	low	tmp allows arbitrary temporary file / directory write via symbolic link dir parameter
1109574	moderate	PostCSS line return parsing error
1112052	high	React Router vulnerable to XSS via Open Redirects
1112057	moderate	React Router has unexpected external redirect via untrusted paths
1112659	high	node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
1113300	high	node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
1113375	high	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
1114200	high	tar has Hardlink Path Traversal via Drive-Relative Linkpath
1114302	high	node-tar Symlink Path Traversal via Drive-Relative Linkpath
1114680	high	Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
1117015	moderate	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
1118827	moderate	ip-address has XSS in Address6 HTML-emitting methods
1119441	moderate	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
1120654	high	tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
1120782	moderate	node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
1123939	moderate	node-tar: Process crash via PAX numeric path type confusion
1123940	critical	node-tar: Decompression/parse DoS via unlimited input
1123941	high	node-tar: Negative tar entry size causes infinite loop in archive replace
1123942	moderate	node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
1124252	high	PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
1124268	moderate	React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
1124272	moderate	React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
1124287	moderate	node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
1124288	high	PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
1130709	moderate	PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset
1130722	high	ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
1136293	moderate	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
1136303	moderate	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Changed files

yarn.lock

Review checklist

• Verify no breaking changes in updated dependencies
• Confirm CI passes

[netlify]

✅ Deploy Preview for sendbird-uikit-react ready!

Name	Link
🔨 Latest commit	24d0d3c
🔍 Latest deploy log	https://app.netlify.com/projects/sendbird-uikit-react/deploys/6a7bc8baeff8d10008953df3
😎 Deploy Preview	https://deploy-preview-1450--sendbird-uikit-react.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.