[GHSA-vr6p-vq2p-6j74] LikeC4 has RCE through vulnerable React and Next.js versions

[davydkov]

Updates

• Affected products

Comments
LikeC4 isn’t impacted by the React vulnerability because it doesn’t ship React at all. React is a peer dependency, so the responsibility for the React version lies entirely with the consuming app.

[github]

Hi there @davydkov! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

This PR updates the LikeC4 security advisory (GHSA-vr6p-vq2p-6j74) to indicate that version 1.46.2 contains a fix for the RCE vulnerability related to React and Next.js dependencies.

Key changes:

• Changed the version range from "last_affected" to "fixed" format, indicating 1.46.2 as the patched version
• Added database-specific metadata to track the last known affected version range

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[helixplant]

Hi @davydkov,
Just to verify, there should be no alerts issued on the likec4 package for this vulnerability? If that is the case then we can start the withdrawal process.

[davydkov]

Hi @helixplant
Correct — there should be no alerts for likec4 related to this vulnerability.
You can proceed with the withdrawal process.

Let me know if you need anything else.