Two high advisories published upstream ~2026-07-21 now fail the unbaselined high+ production audit on every PR run (same class as #5394/#5395 — advisory rot, zero diff involvement):
- blog-site/package-lock.json: svgo 4.0.1 (via astro) — GHSA-2p49-hgcm-8545 (removeScripts leaves executable scripts intact). Non-breaking fix available.
- consumer-prices-core/package-lock.json: fast-uri 3.0.0–3.1.2 — GHSA-4c8g-83qw-93j6 (host confusion via failed IDN canonicalization). Non-breaking fix available.
Observed: PR #5403 first run green 2026-07-21 ~10:40Z, identical lockfiles red at ~21:30Z after a markdown-only push. Blocks gate via required security-audit.
Fix: targeted lockfile bumps ONLY (svgo, fast-uri) — no broad refresh, per the #5395→biome-caret-float lesson.
Two high advisories published upstream ~2026-07-21 now fail the unbaselined high+ production audit on every PR run (same class as #5394/#5395 — advisory rot, zero diff involvement):
Observed: PR #5403 first run green 2026-07-21 ~10:40Z, identical lockfiles red at ~21:30Z after a markdown-only push. Blocks
gatevia required security-audit.Fix: targeted lockfile bumps ONLY (svgo, fast-uri) — no broad refresh, per the #5395→biome-caret-float lesson.