build(deps): bump the website-minor-patch group across 1 directory with 9 updates - #965
Conversation
…th 9 updates Bumps the website-minor-patch group with 9 updates in the /website directory: | Package | From | To | | --- | --- | --- | | [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.5` | `7.0.8` | | [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.2` | `6.0.4` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.7` | `0.41.8` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.7` | `2.5.10` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.0` | `7.2.6` | | [starlight-blog](https://github.com/HiDeoo/starlight-blog/tree/HEAD/packages/starlight-blog) | `0.28.0` | `0.29.0` | | [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.2` | `0.25.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` | Updates `@astrojs/mdx` from 7.0.5 to 7.0.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.8/packages/integrations/mdx) Updates `@astrojs/react` from 6.0.2 to 6.0.4 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.4/packages/integrations/react) Updates `@astrojs/starlight` from 0.41.7 to 0.41.8 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.8/packages/starlight) Updates `@biomejs/biome` from 2.5.7 to 2.5.10 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome) Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `astro` from 7.2.0 to 7.2.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.2.6/packages/astro) Updates `starlight-blog` from 0.28.0 to 0.29.0 - [Release notes](https://github.com/HiDeoo/starlight-blog/releases) - [Changelog](https://github.com/HiDeoo/starlight-blog/blob/main/packages/starlight-blog/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-blog/commits/starlight-blog@0.29.0/packages/starlight-blog) Updates `starlight-links-validator` from 0.25.2 to 0.25.3 - [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases) - [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.3/packages/starlight-links-validator) Updates `vite` from 8.2.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: "@astrojs/mdx" dependency-version: 7.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: "@astrojs/react" dependency-version: 6.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: "@astrojs/starlight" dependency-version: 0.41.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: astro dependency-version: 7.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: starlight-blog dependency-version: 0.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: website-minor-patch - dependency-name: starlight-links-validator dependency-version: 0.25.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: website-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependabot
dependabot
Bot
added
deps
![semgrep-code-tajemniktv[bot]](https://avatars.githubusercontent.com/u/12156943?s=60&v=4){kind=small}
| "tailwindcss": "^4.2.4", | ||
| "typescript": "^6.0.3", | ||
| "vite": "^8.2.1" | ||
| "vite": "^8.2.2" |
There was a problem hiding this comment.
Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.
Why this might be safe to ignore:
This is a development dependency in a package.json file using caret (^) version ranges, which is standard practice in Node.js projects. The project uses an 'overrides' section and likely has a package-lock.json file (as is standard) that locks dependencies to exact versions in production, mitigating dependency confusion risks. The LOW confidence rating and standard development workflow make this a false positive.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.
You can view more details about this finding in the Semgrep AppSec Platform.
| "starlight-blog": "^0.29.0", | ||
| "starlight-image-zoom": "^0.15.0", | ||
| "starlight-links-validator": "^0.25.2", | ||
| "starlight-links-validator": "^0.25.3", |
There was a problem hiding this comment.
Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.
Why this might be safe to ignore:
This low-confidence rule is matching a normal semver range in package.json, not evidence of an exploitable vulnerability in application code. Using a caret version for a public dependency is common and this finding alone does not meaningfully improve security without additional supply-chain risk context.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.
You can view more details about this finding in the Semgrep AppSec Platform.
| "react": "^19.2.8", | ||
| "react-dom": "^19.2.8", | ||
| "starlight-blog": "^0.28.0", | ||
| "starlight-blog": "^0.29.0", |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
starlight-blog uses the floating range ^0.29.0, allowing later compatible releases to enter developer and CI builds. A hijacked matching release could execute during installation or the Astro build and expose source code or deployment secrets.
More details about this
starlight-blog is declared as ^0.29.0, so package installation can select newer 0.x releases allowed by npm's caret range rather than always using 0.29.0. If a later matching release of starlight-blog were hijacked or published with malicious code, an attacker could exploit the normal dependency installation flow:
- An attacker publishes a compromised compatible
starlight-blogrelease, such as0.29.1. - A developer or CI job runs
npm installwhile resolving thedependenciesin thispackage.json; the^0.29.0range permits npm to select that newer release. - The malicious package executes during installation or is included in the Astro build, potentially reading CI environment variables, source files, or deployment credentials and sending them to an attacker-controlled server.
- Other developers or build agents that install the project later may resolve a different
starlight-blogversion, making the dependency behavior and resulting build inconsistent across environments.
To resolve this comment:
✨ Commit fix suggestion
| "starlight-blog": "^0.29.0", | |
| "starlight-blog": "0.29.0", |
View step-by-step instructions
-
Pin
starlight-blogto the exact version by changing the entry to"starlight-blog": "0.29.0". -
Update the npm lockfile to record this exact version and its resolved integrity data with
$ npm install --save-exact starlight-blog@0.29.0. -
Keep the generated
package-lock.jsonalongsidepackage.jsonso future installs use the reviewed dependency version.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.
You can view more details about this finding in the Semgrep AppSec Platform.
| "@types/react-dom": "^19.2.4", | ||
| "astro": "^7.2.0", | ||
| "@types/react-dom": "^19.2.5", | ||
| "astro": "^7.2.6", |
There was a problem hiding this comment.
Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.
Why this might be safe to ignore:
This is a low-confidence dependency version pinning finding in package.json, and the matched caret range is standard package manager usage rather than a directly exploitable issue by itself. Without evidence that installs occur without a lockfile or from an untrusted registry, this does not meaningfully indicate a security vulnerability.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.
You can view more details about this finding in the Semgrep AppSec Platform.
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
1 participant
Bumps the website-minor-patch group with 9 updates in the /website directory:
7.0.57.0.86.0.26.0.40.41.70.41.82.5.72.5.1019.2.419.2.57.2.07.2.60.28.00.29.00.25.20.25.38.2.18.2.2Updates
@astrojs/mdxfrom 7.0.5 to 7.0.8Release notes
Sourced from @astrojs/mdx's releases.
Changelog
Sourced from @astrojs/mdx's changelog.
Commits
d38ed60[ci] release (#17753)660991cFix build error location reporting for MDX and aggregate plugin errors (#17757)0762a83fix: accept all sätteri plugin entry types (#17766)8a31cba[ci] release (#17739)bc171affeat(satteri): update to Sätteri 0.10.x (#17731)52e6c34[ci] release (#17691)Updates
@astrojs/reactfrom 6.0.2 to 6.0.4Release notes
Sourced from @astrojs/react's releases.
Changelog
Sourced from @astrojs/react's changelog.
Commits
8a31cba[ci] release (#17739)52e6c34[ci] release (#17691)Updates
@astrojs/starlightfrom 0.41.7 to 0.41.8Release notes
Sourced from @astrojs/starlight's releases.
Changelog
Sourced from @astrojs/starlight's changelog.
Commits
e81fedf[ci] release (#4137)cd4b665Fix localisation of Expressive Code UI (#4138)cacbc9fAdd WhatsApp icon (#4142)3944311Use a page-specific counter for\<Tabs>IDs (#4133)9b8221cRemove Vitest native config loader warnings (#4129)Updates
@biomejs/biomefrom 2.5.7 to 2.5.10Release notes
Sourced from @biomejs/biome's releases.
... (truncated)
Changelog
Sourced from @biomejs/biome's changelog.
... (truncated)
Commits
05797b1ci: release (#11450)5f1ed34chore: add CodSpeed and Cloudflare to sponsors (#11410)2081460ci: release (#11309)6559e6cfeat: adds theuseAstroClientOnlyDirectiveValuerule for .astro files (#11299)a8798eafeat: useNamedLayer (#11377)85aac73feat(lint): addnoUnsafeTypeAssertionrule (#11221)e65f07efeat(lint): nursery useControlLabel (#11312)ba8aa18feat(lint): adduseTailwindShorthandClasses(#10312)6b8f09cci: release (#11236)23c0369feat(lint): nursery noInvalidPropertyInitValue (#11187)Updates
@types/react-domfrom 19.2.4 to 19.2.5Commits
Updates
astrofrom 7.2.0 to 7.2.6Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
22e439b[ci] release (#17814)29af6daFix FetchState manifest resolution in development (#17812)d38ed60[ci] release (#17753)0fc5f65fix: content image regression (#17810)493796bSkip URL normalization writes that would not change the path (#17416)8797754Fix i18n fallback rewrite returning 500 instead of 404 for missing prerendere...99d3d3dfix: bump compiler (#17741)6661fbefix(dev): break circular import in virtual:astro:routes by importing from ast...60b14ffFix type error when using content collection images after apng support (#17783)3578d45perf(cli): enable the Node.js compile cache (#17782)Updates
starlight-blogfrom 0.28.0 to 0.29.0Release notes
Sourced from starlight-blog's releases.
Changelog
Sourced from starlight-blog's changelog.
Commits
9372411ci: release (#226)6449901feat: stable css selectors (#225)Updates
starlight-links-validatorfrom 0.25.2 to 0.25.3Release notes
Sourced from starlight-links-validator's releases.
Changelog
Sourced from starlight-links-validator's changelog.
Commits
e9dc678ci: release (#174)7f9c3b7fix: redirect validation with a base and under the Bun runtime (#173)Updates
vitefrom 8.2.1 to 8.2.2Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
de1111arelease: v8.2.2cb77e2atest(ssr): add destructing assignment case for moduleRunnerTransform (#23308)9db0b61fix(ssr): rewrite computed key of destructing parameter (#23307)8413052fix: respectresolve.preserveSymlinkswhen resolving root (fix #23197) (#23...05a003efix(config): resolve sourcemap paths against sourcemap location (#23239)495d9fffeat(deps): widen@vitejs/devtoolspeer range to v0.5.0 (#23302)1d9fa39refactor: use JSON import attributes instead of readFileSync in constants (#2...2804636fix(css): don't pass empty targets to lightningcss (#23295)599b44btest(module-runner): simplify server-hmr tests (CVE-2026-67213 — nanoid: Denial of Service via infinite loop in random ID generation