From ed7814367a8111d357cdca0df2d6ce848dc73a34 Mon Sep 17 00:00:00 2001 From: Tim Gossrau Date: Fri, 18 Sep 2026 13:21:03 +0200 Subject: [PATCH] chore(deps): bump js-yaml to 4.3.2 and svgo to 2.8.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears GHSA-2883-xcg3-v3hh, GHSA-w27v-7q3p-w38r and GHSA-4vpr-x523-8j87. Both are transitive devDependencies — js-yaml under eslint, svgo under rollup-plugin-postcss — so nothing here reaches the published dist/. Lockfile only: both land inside the existing semver ranges, so npm audit fix resolves them without --force and package.json is untouched. The svgo advisories concern removeScripts sanitising SVG. The stylesheet only references icon paths and carries no inline SVG, so postcss-svgo has nothing to process in this build either way. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 280b187..624393a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2551,9 +2551,9 @@ "license": "ISC" }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { @@ -3968,9 +3968,9 @@ } }, "node_modules/svgo": { - "version": "2.8.3", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.3.tgz", - "integrity": "sha512-5EZD0pafXX6PphdwOGCiVLDSaV1xyuQao2blHajHLsPxr07q4mmEjdtXEWgG07ae2mIz8Ex2CDXNCTiXhy3Khw==", + "version": "2.8.4", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.4.tgz", + "integrity": "sha512-2GJ4h3rl13qYTdwllaK6QlL8tG+UrM8626V2Ylcd/yBUv2Y/EwLsYisVV6UDCRmlk+C74G8nMpxJCk0RWPdDCw==", "dev": true, "license": "MIT", "dependencies": {