## Summary Resolves **10 open Dependabot alerts** across 5 CVEs and dismisses 2 low-severity esbuild alerts as tolerable risk. ### Alerts Fixed | Alert(s) | Package | Severity | CVE | Fix | |----------|---------|----------|-----|-----| | #180, #181 | `tar` | Medium | GHSA-vmf3-w455-68vh | Bump direct pin `7.5.11` -> `7.5.16` | | #178, #179 | `form-data` | High | GHSA-hmw2-7cc7-3qxx | `pnpm.overrides` for `4.0.6` (v4) and `2.5.6` (v2) | | #172, #176 | `vite` (root) | High + Medium | GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3 | Add as direct devDep `^7.3.5` + override | | #173, #177 | `vite` (docs) | High + Medium | same | `pnpm.overrides` in docs | | #174, #175 | `astro` | High + Medium | GHSA-2pvr-wf23-7pc7, GHSA-jrpj-wcv7-9fh9 | `pnpm update` -> `6.4.8` | ### Alerts Dismissed (tolerable_risk) | Alert(s) | Package | Severity | Reason | |----------|---------|----------|--------| | #167, #168 | `esbuild` | Low | GHSA-g7r4-m6w7-qqqr - Windows dev-server only vulnerability. Craft is a CLI tool, docs is a static site. Transitive dep of `vite@7.3.5` which pins `esbuild@^0.27.0` - cannot fix without vite 8 major bump. | ## Changes ### Root project (`package.json`) - `tar`: `7.5.11` -> `7.5.16` (direct pin bump) - `vite`: added as devDependency at `^7.3.5` (was only transitive via vitest) - `pnpm.overrides`: added `form-data@>=4: ^4.0.6`, `form-data@<3: ^2.5.6`, `vite: ^7.3.5` ### Docs project (`docs/package.json`) - `astro`: resolved `5.16.11` -> `6.4.8` (specifier `^6.1.10` allowed it) - `@astrojs/starlight`: resolved `0.37.3` -> `0.38.3` - `pnpm.overrides`: added `vite: ^7.3.5` ## Verification - `pnpm build` - passed - `pnpm test` - 1025 passed, 1 skipped - `pnpm lint` - 0 errors - `pnpm docs:build` - 27 pages built successfully

Uh oh!

Uh oh!

Publish a version of Craft GitHub action #180

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions