Skip to content

chore: patch dependencies — fix 9 CVEs across root and docs packages#5

Merged
matthiasbaldi merged 2 commits intomainfrom
copilot/patch-dependencies-and-rerun-tests
Apr 28, 2026
Merged

chore: patch dependencies — fix 9 CVEs across root and docs packages#5
matthiasbaldi merged 2 commits intomainfrom
copilot/patch-dependencies-and-rerun-tests

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 28, 2026

Bumps all dependencies to latest in-range versions and upgrades docs to astro v6 to address security vulnerabilities. Net result: 0 audit findings in both packages.

Root package

Package Before After Severity
fastify 5.7.4 5.8.5 🔴 High — request spoofing (GHSA-444r-cwp2-x5xf), content-type bypass (GHSA-247c-9743-5963)
node-forge 1.3.3 1.4.0 🔴 High — basicConstraints bypass, Ed25519 forgery, RSA-PKCS forgery, BigInteger DoS
@fastify/static (transitive) patched 🟠 Moderate — path traversal, route guard bypass
brace-expansion (transitive) patched 🟠 Moderate — ReDoS
yaml (transitive) patched 🟠 Moderate — stack overflow
@fastify/swagger-ui 5.2.5 5.2.6
@types/chrome 0.1.37 0.1.40
@types/node 25.3.0 25.6.0

Docs package

Astro v5→v6 is a breaking upgrade but required to close an XSS in define:vars (GHSA-j687-52p2-xcff). Dependent packages upgraded in lockstep:

  • astro: 5.18.x → 6.1.9
  • @astrojs/starlight: 0.37.x → 0.38.4 (requires astro v6)
  • starlight-openapi: 0.22.x → 0.25.0 (requires astro v6 / starlight 0.38+)
  • astro-mermaid: 1.3.x → 2.0.1

Copilot AI and others added 2 commits April 27, 2026 22:13
Agent-Logs-Url: https://github.com/secanis/tlscheck/sessions/b67d79a0-5cb2-4d9d-831e-09450c5651e4

Co-authored-by: matthiasbaldi <12791996+matthiasbaldi@users.noreply.github.com>
…test versions

Agent-Logs-Url: https://github.com/secanis/tlscheck/sessions/b67d79a0-5cb2-4d9d-831e-09450c5651e4

Co-authored-by: matthiasbaldi <12791996+matthiasbaldi@users.noreply.github.com>
@matthiasbaldi matthiasbaldi marked this pull request as ready for review April 28, 2026 19:21
@matthiasbaldi matthiasbaldi merged commit 6be8f19 into main Apr 28, 2026
7 of 8 checks passed
@matthiasbaldi matthiasbaldi deleted the copilot/patch-dependencies-and-rerun-tests branch April 28, 2026 19:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants