fix(security): remediate known CVEs in JS deps - #93
Closed
felixgeelhaar wants to merge 1 commit into
Closed
Conversation
Force-patched transitive npm dependencies via package.json overrides to eliminate net-new high-severity CVEs flagged by nox 1.16.1. - fast-uri 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676, host confusion via failed IDN canonicalization; GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, host confusion via literal backslash authority delimiter) - postcss 8.5.16 -> 8.5.18+ (GHSA-r28c-9q8g-f849, path traversal in source map auto-loading) - svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts plugin leaves some executable scripts intact) Verified: build (astro build) and tests (vitest, 29/29) pass; nox scan reports 0 net-new critical/high findings. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
This was referenced Jul 25, 2026
felixgeelhaar
added a commit
that referenced
this pull request
Jul 25, 2026
* fix(ci): run CI on docs-only PRs so required checks can report Branch protection requires `ci / Lint`, `ci / Test (ubuntu-latest)`, `ci / Build` and `ci / Security (nox)`, but the pull_request trigger had paths-ignore for **.md, docs/** and LICENSE. A docs-only PR therefore skipped the whole workflow, the required checks never reported, and the PR was BLOCKED forever — mergeable only via an admin override (this is what blocked #93). Drop paths-ignore from the pull_request trigger so the workflow always runs and reports its required contexts. Running CI on a docs PR is cheap (no Go code changed, so the build/test caches hit). The push-to-main trigger keeps its paths-ignore, so merges of docs changes still skip CI. Mirrors the same fix already applied in warden and nox. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom * fix(security): remediate known CVEs in JS deps Force-patched transitive npm dependencies via package.json overrides to eliminate net-new high-severity CVEs flagged by nox 1.16.1. - fast-uri 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676, host confusion via failed IDN canonicalization; GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, host confusion via literal backslash authority delimiter) - postcss 8.5.16 -> 8.5.18+ (GHSA-r28c-9q8g-f849, path traversal in source map auto-loading) - svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts plugin leaves some executable scripts intact) Verified: build (astro build) and tests (vitest, 29/29) pass; nox scan reports 0 net-new critical/high findings. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
Collaborator
Author
|
Superseded by #94, which carries this same dependency fix plus the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of the fleet-wide nox 1.16.1 security upgrade. Force-patches transitive npm dependencies in
docs/viapackage.jsonoverridesto eliminate net-new high-severity CVEs.Version bumps
fast-uripostcsssvgoAll bumps stay within the installed major version (minimal, non-breaking).
fast-uri3.1.4 fixes both 3.x advisory ranges (3.1.3 and 3.1.4);svgo4.0.2 fixes the 4.x range of the multi-range advisory.Verification
npm run build(astro) — passes, 26 pages builtnpm test(vitest) — 29/29 passnox scan— 0 net-new critical/high findings (Status != baselined)Only
docs/package.json+docs/package-lock.jsonare changed; no baseline files touched.https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom