From 39422bee8177883bca67b81a854f36206dc07323 Mon Sep 17 00:00:00 2001 From: Kyle Hounslow Date: Mon, 27 Jul 2026 20:33:03 +0000 Subject: [PATCH 1/2] chore(deps): pin dompurify, js-yaml, postcss-selector-parser in starlight-docs Clears CVEs in the docs/starlight-docs lockfile via package.json overrides, all within existing majors: - dompurify 3.4.5 -> 3.4.12 (CVE-2026-49978 CRITICAL 9.3, +8 more, via mermaid) - js-yaml 4.1.1 -> 4.3.0 (CVE-2026-59869 7.5, CVE-2026-53550 5.3, via @astrojs/starlight) - postcss-selector-parser 6.1.2 -> 6.1.4 (CVE-2026-9358 4.3, via postcss-nested) postcss-selector-parser is a transitive dep of postcss-nested (^6.1.1); a lockfile refresh alone keeps it at 6.1.2, so it needs an explicit override. CVE-2026-9358's fix was backported to 6.1.3, so ^6.1.3 clears it. Closes #258, closes #278 Signed-off-by: Kyle Hounslow --- docs/starlight-docs/package-lock.json | 28 ++++++++++++++++++--------- docs/starlight-docs/package.json | 5 +++++ 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/docs/starlight-docs/package-lock.json b/docs/starlight-docs/package-lock.json index c303378a..8d93f739 100644 --- a/docs/starlight-docs/package-lock.json +++ b/docs/starlight-docs/package-lock.json @@ -3433,9 +3433,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.5", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.5.tgz", - "integrity": "sha512-OrwIBKsdNSVEeubdJ1HBv/wNENRM9ytAVCv7YXt//A3vPdVMNuACRqK9mXCGCBW2ln7BT/A4X0jXHo2Gu89miA==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -4443,9 +4443,19 @@ } }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -6032,9 +6042,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz", - "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==", + "version": "6.1.4", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", + "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", diff --git a/docs/starlight-docs/package.json b/docs/starlight-docs/package.json index 6c0fe791..175cf7b1 100644 --- a/docs/starlight-docs/package.json +++ b/docs/starlight-docs/package.json @@ -16,5 +16,10 @@ "mermaid": "^11.15.0", "sharp": "^0.34.2", "starlight-links-validator": "^0.24.0" + }, + "overrides": { + "dompurify": "3.4.12", + "js-yaml": "4.3.0", + "postcss-selector-parser": "^6.1.3" } } From 65f2f231082b1dc22a20119aab39857dd8eca910 Mon Sep 17 00:00:00 2001 From: Kyle Hounslow Date: Tue, 28 Jul 2026 17:41:47 +0000 Subject: [PATCH 2/2] chore(deps): drop redundant overrides in starlight-docs The dompurify/js-yaml/postcss-selector-parser overrides are unnecessary: the parent ranges (mermaid dompurify ^3.3.1, starlight/astro js-yaml ^4.1.1, postcss-nested postcss-selector-parser ^6.1.1) already span the patched versions, so the lockfile pins 3.4.12 / 4.3.0 / 6.1.4 on its own. Regenerating with the block removed produces a byte-identical lockfile (0 version changes); npm ci + build stay green, links valid, all three CVEs remain cleared. Signed-off-by: Kyle Hounslow --- docs/starlight-docs/package.json | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/starlight-docs/package.json b/docs/starlight-docs/package.json index 175cf7b1..6c0fe791 100644 --- a/docs/starlight-docs/package.json +++ b/docs/starlight-docs/package.json @@ -16,10 +16,5 @@ "mermaid": "^11.15.0", "sharp": "^0.34.2", "starlight-links-validator": "^0.24.0" - }, - "overrides": { - "dompurify": "3.4.12", - "js-yaml": "4.3.0", - "postcss-selector-parser": "^6.1.3" } }