adm-zip@0.5.10 vulnerability (CVE-2026-39244)

[felipeloge]

Describe the bug

There is a vulnerability in adm-zip@0.5.10 used by dts-plugin package from @mopdule-federation/core.

Proposed fix: upgrade to version 0.5.18.

Reproduction

https://github.com/module-federation/core/blob/main/packages/dts-plugin/package.json#L72

Used Package Manager

npm

System Info

n/a

Validations

• Read the docs.
• Read the common issues list.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Module federation issue and not a framework-specific issue.
• The provided reproduction is a minimal reproducible example of the bug.

[klimashkin]

What was the reason behind pinning adm-zip to the exact version?
Can the @module-federation/dts-plugin package use adm-zip: "^0.5.18"?