chore(deps): bump astro 7.0.6 -> 7.1.0 (GHSA-4g3v-8h47-v7g6) - #95
Merged
Conversation
Clears a medium-severity reflected XSS advisory in astro (GHSA-4g3v-8h47-v7g6). Minor bump within 7.x; the docs range moves to ^7.1.0 and the lockfile resolves to 7.1.3. Deliberately NOT addressed: @babel/core 7.29.0 (GHSA-4x5r-pxfx-6jf8, low). The only published fix is 8.0.0-rc.6 -- a release candidate and a major bump. Not worth the breakage risk for a low-severity, build-time- only advisory. Revisit when Babel 8 is stable. Non-gating remediation: the CI gate only fails on net-new critical/high. Verified with `nox scan` -- the astro advisory is gone and there are 0 active critical/high findings. `npm run build` and `npm run check` for docs/ pass (0 errors). Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the residual medium-severity dependency advisory in
docs/.Change
astro^7.1.0, lockfile resolves 7.1.3)astrois a direct dependency ofdocs/, so this is a plain minor bump within 7.x — nooverridesneeded and no major-version movement.Deliberately not fixed:
@babel/core7.29.0@babel/core7.29.0 carries GHSA-4x5r-pxfx-6jf8 (low — arbitrary file read via sourceMappingURL). The only published fix is8.0.0-rc.6: a release candidate and a major version bump.Forcing an RC major into the docs toolchain to clear a low-severity, build-time-only advisory is a worse trade than carrying the finding. Left in place intentionally — revisit when Babel 8 ships stable. It is not baselined or waived; it stays visible in scan output.
Verification
nox scan— the astro advisory is gone; 0 active critical/high findings (no regression).npm run buildindocs/passes (26 pages built).npm run checkpasses: 0 errors, 0 warnings.Notes
docs/package.jsonanddocs/package-lock.jsonare touched. The build regenerates the checked-indocs/dist/artifacts; those were reverted so this PR stays a pure dependency change.https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom