mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-30 22:21:58 +01:00
ARUNAVO RAY
e49cf0e367
Every one of these advisories was published on 2026-09-08 between 20:30 and 21:26 UTC, against the versions this repository was already pinning from the earlier rounds. Same package names, new CVEs, not a regression from anything that merged today. **Application** (the nine Docker Scout alerts on main) | Package | Was | Now | Advisory | | --- | --- | --- | --- | | astro | 7.1.0 | 7.3.2 (floor ^7.2.8) | GHSA-26w7-cxv4-gfx2, remote code execution through AVIF image optimization (critical) | | @xmldom/xmldom | 0.8.13 | 0.8.15 | eight advisories, CVE-2026-83605 through CVE-2026-83619 (high) | | sharp | floor ^0.35.0 | ^0.35.4 | GHSA-rgj7-g3m4-5g8c, libheif | | js-yaml | floor ^4.3.1 | ^4.3.2 | GHSA-2883-xcg3-v3hh | | svgo | (no floor) | ^4.1.0 | GHSA-w27v-7q3p-w38r, GHSA-4vpr-x523-8j87 | **Documentation site** (the six Dependabot alerts against `www/pnpm-lock.yaml`) astro to ^7.2.8 (resolves 7.3.2), and pnpm overrides for sharp ^0.35.4, svgo ^4.1.0 and js-yaml ^4.3.2. That covers all six, including the moderate Astro authorization bypass (GHSA-376h-93r7-7g6f) which 7.2.4 already fixed. This supersedes the two Dependabot pull requests, which only cover the site and overlap with each other. Checked: 906 tests pass, `bun run build` passes, and the site builds its 37 pages. The lockfile change is confined to the bumped packages and their transitive resolution.
45 lines
1.1 KiB
JSON
45 lines
1.1 KiB
JSON
{
|
|
"name": "www",
|
|
"type": "module",
|
|
"version": "1.2.0",
|
|
"scripts": {
|
|
"dev": "astro dev",
|
|
"build": "astro build",
|
|
"preview": "astro preview",
|
|
"astro": "astro"
|
|
},
|
|
"dependencies": {
|
|
"@astrojs/mdx": "^7.0.3",
|
|
"@astrojs/react": "^6.0.1",
|
|
"@astrojs/sitemap": "^3.7.3",
|
|
"@radix-ui/react-slot": "^1.3.0",
|
|
"@splinetool/react-spline": "^4.1.0",
|
|
"@splinetool/runtime": "^1.12.98",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@types/canvas-confetti": "^1.9.0",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"astro": "^7.2.8",
|
|
"canvas-confetti": "^1.9.4",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^1.24.0",
|
|
"react": "^19.2.7",
|
|
"react-dom": "^19.2.7",
|
|
"tailwind-merge": "^3.6.0",
|
|
"tailwindcss": "^4.3.3"
|
|
},
|
|
"devDependencies": {
|
|
"tw-animate-css": "^1.4.0"
|
|
},
|
|
"packageManager": "pnpm@10.32.1",
|
|
"pnpm": {
|
|
"overrides": {
|
|
"esbuild@>=0.27.3 <0.28.1": ">=0.28.1",
|
|
"sharp": "^0.35.4",
|
|
"svgo": "^4.1.0",
|
|
"js-yaml": "^4.3.2"
|
|
}
|
|
}
|
|
}
|