External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): patch 4 HIGH/CRITICAL transitive CVEs (fast-uri, svgo, sharp, tar) (#619)

Browse Source 
Scoped pnpm overrides for four transitive HIGH/CRITICAL CVEs; regenerating the lockfile also cleared brace-expansion.

- fast-uri >=4.1.1 (CVE-2026-16221, WHATWG backslash URL-parser differential; transitive via ajv)
- astro>svgo 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts leaves executable scripts)
- astro>sharp 0.35.3 (GHSA-f88m-g3jw-g9cj, inherited libvips CVEs); runtime image-engine sharp ^0.35.3 untouched
- tar >=7.5.19 (CVE-2026-59873 CRITICAL, CVE-2026-59874)

trivy fs HIGH/CRITICAL 4->0; pnpm audit high 3->0; landing build + api typecheck pass.
This commit is contained in:
SnapOtter
2026-07-23 00:01:02 +08:00
committed by GitHub
parent 44d8109486
commit 10a2aabe58
2 changed files with 19 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+4 -2
View File
@@ -95,12 +95,14 @@
"license": "AGPL-3.0",
"pnpm": {
"overrides": {
"fast-uri": ">=3.1.2",
"fast-uri": ">=4.1.1",
"astro>sharp": "0.35.3",
"astro>svgo": "4.0.2",
"handlebars": ">=4.7.9",
"glob": ">=10.5.0",
"minimatch": ">=9.0.6",
"picomatch": ">=4.0.4",
"tar": ">=7.5.11",
"tar": ">=7.5.19",
"lodash": ">=4.18.0",
"lodash-es": ">=4.18.0",
"brace-expansion>minimatch": "^2.0.2",