Skip to content

build(deps): bump the website-minor-patch group across 1 directory with 6 updates #956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tajemniktv merged 1 commit into from
Aug 16, 2026
Merged

build(deps): bump the website-minor-patch group across 1 directory with 6 updates #956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
151 changes: 61 additions & 90 deletions website/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions website/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@
"@astrojs/partytown": "^2.1.7",
"@astrojs/react": "^5.0.7",
"@astrojs/sitemap": "^3.7.3",
"@astrojs/starlight": "^0.41.5",
"@biomejs/biome": "^2.5.6",
"@astrojs/starlight": "^0.41.7",
"@biomejs/biome": "^2.5.7",
"@tailwindcss/vite": "^4.3.3",
"@types/react": "^19.2.17",
"@types/react-dom": "^19.2.3",
"astro": "^7.1.6",
"@types/react": "^19.2.18",
"@types/react-dom": "^19.2.4",
"astro": "^7.2.0",

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a low-confidence dependency version pinning finding in package.json, and the matched caret range is standard package manager usage rather than a directly exploitable issue by itself. Without evidence that installs occur without a lockfile or from an untrusted registry, this does not meaningfully indicate a security vulnerability.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

"react": "^19.2.8",
"react-dom": "^19.2.8",
"starlight-blog": "^0.28.0",
Expand All @@ -32,7 +32,7 @@
"starlight-videos": "^0.5.0",
"tailwindcss": "^4.2.4",
"typescript": "^6.0.3",
"vite": "^8.2.0"
"vite": "^8.2.1"

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a development dependency in a package.json file using caret (^) version ranges, which is standard practice in Node.js projects. The project uses an 'overrides' section and likely has a package-lock.json file (as is standard) that locks dependencies to exact versions in production, mitigating dependency confusion risks. The LOW confidence rating and standard development workflow make this a false positive.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

},
"overrides": {
"vite": "$vite"
Expand Down
Loading