mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
d90b91604f
- postcss 8.5.15 -> 8.5.23 (GHSA-r28c-9q8g-f849, source-map path traversal) - brace-expansion override ^5.0.7 -> ^5.0.8 (GHSA-mh99-v99m-4gvg, DoS) react-router: pin react-router-dom to exact 7.18.1 (direct dep) and react-router to 7.18.1 via overrides (transitive). 7.18.1 is the most-patched 7.x -- it clears 14 advisories that older 7.x releases carry, several reachable from a SPA (open- redirect XSS in Link/useNavigate, route-matching DoS). The one remaining advisory, GHSA-qwww-vcr4-c8h2, is RSC-mode-only; Bambuddy is a Vite SPA using BrowserRouter with no RSC runtime (@react-router/server not installed), so the path is unreachable. The only version that fully clears npm audit is the 8.3.0 major (no react-router-dom 8.x exists; it needs migrating 50 import sites plus a React peer bump), deferred as its own change. Because a version pin can't stop npm from reporting the theoretical 7.11.0 downgrade as fixAvailable, the ci.yml (hard) and security.yml (nightly issue) audit gates gain a narrow, documented allowlist keyed on the GHSA id. It resolves the react-router-dom -> react-router advisory chain and stays fail-closed: a different advisory on react-router still fails the gate, and an isSemVerMajor guard drops the exemption the moment a non-major fix ships, forcing us to take it. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| workflows.disabled | ||
| CODEOWNERS | ||
| FUNDING.yml | ||
| MAINTAINERS.md | ||
| PULL_REQUEST_TEMPLATE.md | ||