fix: resolve all npm audit vulnerabilities - #27
Merged
Conversation
`npm audit` reported 11 vulnerabilities (4 high, 5 moderate, 2 low). Two changes: 1. `npm audit fix` — bumps astro, postcss, sharp, svgo, fast-uri and the yaml/yaml-language-server/@astrojs/language-server chain. Clears 8 of 11. 2. Drop the `overrides.esbuild = 0.27.7` pin. vite 8.1.5 depends on esbuild ^0.28.0, so the override was downgrading esbuild into the range affected by GHSA-g7r4-m6w7-qqqr (arbitrary file read via the dev server on Windows). Without the pin, esbuild resolves to 0.28.1 and the last 3 advisories clear. `npm audit` now reports 0 vulnerabilities. Playwright E2E suite passes 32/32; the bumped @playwright/test needs `npx playwright install chromium` (browser revision 1228) on machines with a cached older revision. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015MkyFmv3JPCkTaFhPVUFtg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #26
What
Clears all 11
npm auditfindings (4 high, 5 moderate, 2 low) → 0 vulnerabilities.How
npm audit fix— bumpsastro,postcss,sharp,svgo,fast-uriand the
yaml→yaml-language-server→volar-service-yaml→@astrojs/language-serverchain. Clears 8 of 11. No breaking-change flagneeded (
--forcewas not used).Removed
overrides.esbuild = 0.27.7frompackage.json.vite@8.1.5depends on
esbuild@^0.28.0, so the override was downgrading esbuild intothe range affected by GHSA-g7r4-m6w7-qqqr (arbitrary file read via the dev
server on Windows). Dropping the pin resolves esbuild to
0.28.1and clearsthe remaining 3 advisories.
All affected packages are dev/build-time only — nothing changes in the shipped
dist/output.Verification
npm audit→found 0 vulnerabilitiesnpm ls esbuild→esbuild@0.28.1under bothviteandastronpm test(Playwright E2E, self-contained) → 32/32 passedNote for reviewers: the bumped
@playwright/testwants browser revision 1228.On a machine with an older cached revision the suite fails to launch until
npx playwright install chromiumis run once. CI installs browsers per run, soit is unaffected.