From 02ae6327ba0a3d4e290ef92aa4f9e8440ed4b5a8 Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sat, 25 Jul 2026 17:53:27 +0200 Subject: [PATCH] fix(security): remediate known CVEs in JS deps Force-patched transitive npm dependencies via package.json overrides to eliminate net-new high-severity CVEs flagged by nox 1.16.1. - fast-uri 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676, host confusion via failed IDN canonicalization; GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, host confusion via literal backslash authority delimiter) - postcss 8.5.16 -> 8.5.18+ (GHSA-r28c-9q8g-f849, path traversal in source map auto-loading) - svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts plugin leaves some executable scripts intact) Verified: build (astro build) and tests (vitest, 29/29) pass; nox scan reports 0 net-new critical/high findings. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom --- docs/package-lock.json | 26 +++++++++++++------------- docs/package.json | 5 ++++- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/package-lock.json b/docs/package-lock.json index 78e47e8..fb72b18 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -4950,9 +4950,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ { @@ -5991,9 +5991,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.15", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz", - "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "funding": [ { "type": "github", @@ -6224,9 +6224,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "funding": [ { "type": "opencollective", @@ -6243,7 +6243,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -6806,9 +6806,9 @@ } }, "node_modules/svgo": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz", - "integrity": "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz", + "integrity": "sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==", "license": "MIT", "dependencies": { "commander": "^11.1.0", diff --git a/docs/package.json b/docs/package.json index 4aaabf2..8902866 100644 --- a/docs/package.json +++ b/docs/package.json @@ -25,6 +25,9 @@ }, "overrides": { "devalue": "^5.8.1", - "yaml": "^2.9.0" + "yaml": "^2.9.0", + "fast-uri": "^3.1.4", + "postcss": "^8.5.18", + "svgo": "^4.0.2" } }