Summary
The locked docs dependency tree currently reports five advisories through npm audit: four high-severity and one moderate-severity finding. The docs check and production static build still pass.
Observed on master at afeec142a24dac622a7ff6f54d0f5021f319fb17.
Current findings
sharp: high, direct dependency, affected <0.35.0postcss: high, transitive, affected <=8.5.17svgo: high, transitive, affected 4.0.0 - 4.0.1fast-uri: high, transitive, affected 3.0.0 - 3.1.3astro: moderate, direct dependency, affected 2.9.0 - 7.0.9
sharp reports a semver-major fix; the other findings report fixes available.
Acceptance criteria
- Upgrade the direct dependencies and refresh
docs/package-lock.json so these findings are removed or document a reviewed exception for any remaining advisory.
npm --prefix docs ci passes.npm --prefix docs run check passes.PUBLIC_DOCS_SITE=https://anvil.brokk.ai PUBLIC_DOCS_BASE=/ npm --prefix docs run build passes.- Add an appropriate dependency-audit check to CI if we want regressions caught automatically.
Summary
The locked docs dependency tree currently reports five advisories through
npm audit: four high-severity and one moderate-severity finding. The docs check and production static build still pass.Observed on master at
afeec142a24dac622a7ff6f54d0f5021f319fb17.Current findings
sharp: high, direct dependency, affected<0.35.0postcss: high, transitive, affected<=8.5.17svgo: high, transitive, affected4.0.0 - 4.0.1fast-uri: high, transitive, affected3.0.0 - 3.1.3astro: moderate, direct dependency, affected2.9.0 - 7.0.9sharpreports a semver-major fix; the other findings report fixes available.Acceptance criteria
docs/package-lock.jsonso these findings are removed or document a reviewed exception for any remaining advisory.npm --prefix docs cipasses.npm --prefix docs run checkpasses.PUBLIC_DOCS_SITE=https://anvil.brokk.ai PUBLIC_DOCS_BASE=/ npm --prefix docs run buildpasses.