Repository navigation
Move four dependencies past their security advisories (Closes #410) - #428
Merged
Merged
Conversation
`just audit` failed on dev in both trees. Each advisory is fixed by a patch release inside the versions already in use, so nothing is excused. Rust, Cargo.lock only: - rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382) - webpki-root-certs 1.0.9 -> 1.0.10 (RUSTSEC-2026-0383) - webpki-roots 1.0.9 -> 1.0.10 (RUSTSEC-2026-0381) The targeted update also re-pointed tempfile from getrandom 0.4.3 to 0.3.4. tempfile accepts both and both were already in the tree. The interface, dev dependencies only: - vite 8.2.2 -> 8.2.4: the launch-editor high (GHSA-587h-7wmj-h5pm) and the moderates and low on vite's dev server. 8.2.4 is the 8.2 line's fix; 8.3 was not taken. - vitest 4.1.11 -> 4.1.12: two @vitest/mocker moderates published after the ticket (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp). chai and tinyrainbow moved with it. npm raised the floors in package.json so a fresh resolve can't land below the fix. The low cookie advisory under SvelteKit stays below the bar, as the audit recipe's comment already explains. No changelog line: a cook sees nothing different. Closes #410 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01126KLKw9pGwH2vG3r1i2VL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Each advisory is fixed by a patch release inside the versions already in use. Nothing goes into
deny.tomlorui/npm-audit-exceptions.json.npm installraised the floors inui/package.jsonto^8.2.4and^4.1.12. The lowcookieadvisory under SvelteKit stays below the bar, as theauditrecipe's comment explains. No changelog line, because a cook sees nothing different.Evidence
just auditfails. cargo-deny names the three RUSTSEC advisories, and npm audit fails onvite: launch-editor(high).After:
just auditprintsboth dependency trees are clean at the levels this gate enforces.just checkpasses.just testpasses: every Rust suite, plus 1379 screen tests in 68 files.just screens, no console error).import_web_linkon a BBC Good Food recipe completed, with the page and its photograph fetched over HTTPS through the new rustls-webpki. The test recipe was deleted afterwards.integrityfields equalnpm view <pkg> dist.integrityfor vite, vitest, chai and tinyrainbow, andcargo fetch --lockedpasses.Merge Danger
Door: two-way
Reverting the commit puts the old lockfiles back.
Blast Radius: outbound-TLS
A site whose certificate chain runs through the distrusted emSign intermediates now fails to import from a link. That is the fix doing its job. The vite and vitest moves touch development and tests only.
🤖 Generated with Claude Code
https://claude.ai/code/session_01126KLKw9pGwH2vG3r1i2VL