Skip to content

build(deps): bump the website-minor-patch group across 1 directory with 9 updates - #968

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/website/dev/website-minor-patch-8414d1310a
Closed

build(deps): bump the website-minor-patch group across 1 directory with 9 updates#968
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/website/dev/website-minor-patch-8414d1310a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the website-minor-patch group with 9 updates in the /website directory:

Package From To
@astrojs/react 6.0.2 6.0.5
@astrojs/sitemap 3.7.3 3.7.4
@astrojs/starlight 0.41.7 0.41.10
@biomejs/biome 2.5.7 2.5.11
@types/react-dom 19.2.4 19.2.5
astro 7.2.0 7.2.10
starlight-blog 0.28.0 0.29.0
starlight-links-validator 0.25.2 0.25.3
vite 8.2.1 8.2.2

Updates @astrojs/react from 6.0.2 to 6.0.5

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​6.0.5

Patch Changes

  • Updated dependencies [f8e9458]:
    • @​astrojs/internal-helpers@​0.11.0

@​astrojs/react@​6.0.4

Patch Changes

  • Updated dependencies [05763a0]:
    • @​astrojs/internal-helpers@​0.10.4

@​astrojs/react@​6.0.3

Patch Changes

  • Updated dependencies [8c193f6]:
    • @​astrojs/internal-helpers@​0.10.3
Changelog

Sourced from @​astrojs/react's changelog.

6.0.5

Patch Changes

  • Updated dependencies [f8e9458]:
    • @​astrojs/internal-helpers@​0.11.0

6.0.4

Patch Changes

  • Updated dependencies [05763a0]:
    • @​astrojs/internal-helpers@​0.10.4

6.0.3

Patch Changes

  • Updated dependencies [8c193f6]:
    • @​astrojs/internal-helpers@​0.10.3
Commits

Updates @astrojs/sitemap from 3.7.3 to 3.7.4

Release notes

Sourced from @​astrojs/sitemap's releases.

@​astrojs/sitemap@​3.7.4

Patch Changes

  • #17851 52d3f56 Thanks @​astro-factory! - Fixes the sitemap outputting a URL with an empty path for the homepage (e.g. https://example.com instead of https://example.com/) when trailingSlash is set to "never" or build.format is set to "file"
Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.4

Patch Changes

  • #17851 52d3f56 Thanks @​astro-factory! - Fixes the sitemap outputting a URL with an empty path for the homepage (e.g. https://example.com instead of https://example.com/) when trailingSlash is set to "never" or build.format is set to "file"
Commits

Updates @astrojs/starlight from 0.41.7 to 0.41.10

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.10

Patch Changes

@​astrojs/starlight@​0.41.9

Patch Changes

@​astrojs/starlight@​0.41.8

Patch Changes

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.10

Patch Changes

0.41.9

Patch Changes

0.41.8

Patch Changes

Commits

Updates @biomejs/biome from 2.5.7 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

Updates astro from 7.2.0 to 7.2.10

Release notes

Sourced from astro's releases.

astro@7.2.10

Patch Changes

  • #17262 f8e9458 Thanks @​Princesseuh! - Fixes @astrojs/markdown-remark being pinned to an exact version.

  • #17874 10c7e63 Thanks @​astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtime Invalid URL crash at server boot

  • #17869 2548abf Thanks @​ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.

  • #17878 76eff3d Thanks @​ematipico! - Fixes browser heuristic caching for cached responses that include Last-Modified or ETag validators

  • #17833 413a6e7 Thanks @​astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern

  • #17872 f7191cc Thanks @​jx-grxf! - Fixes Markdown images in content collections rendering an empty srcset attribute when no responsive candidates are generated.

  • #17755 157c500 Thanks @​matthewp! - Fixes a bug where editing a content collection entry during astro dev on Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.

  • Updated dependencies [f8e9458, f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/markdown-satteri@​0.4.0

astro@7.2.9

Patch Changes

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.10

Patch Changes

  • #17262 f8e9458 Thanks @​Princesseuh! - Fixes @astrojs/markdown-remark being pinned to an exact version.

  • #17874 10c7e63 Thanks @​astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtime Invalid URL crash at server boot

  • #17869 2548abf Thanks @​ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.

  • #17878 76eff3d Thanks @​ematipico! - Fixes browser heuristic caching for cached responses that include Last-Modified or ETag validators

  • #17833 413a6e7 Thanks @​astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern

  • #17872 f7191cc Thanks @​jx-grxf! - Fixes Markdown images in content collections rendering an empty srcset attribute when no responsive candidates are generated.

  • #17755 157c500 Thanks @​matthewp! - Fixes a bug where editing a content collection entry during astro dev on Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.

  • Updated dependencies [f8e9458, f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/markdown-satteri@​0.4.0

7.2.9

Patch Changes

7.2.8

Patch Changes

7.2.7

Patch Changes

... (truncated)

Commits

Updates starlight-blog from 0.28.0 to 0.29.0

Release notes

Sourced from starlight-blog's releases.

starlight-blog@0.29.0

Minor Changes

  • #225 6449901 Thanks @​HiDeoo! - Improves the generated blog markup to provide more consistent CSS selectors for custom styling and theming.

    ⚠️ Potentially breaking change: If you have custom CSS targeting generated blog markup, you may want to double check the visual appearance of the generated pages when updating.

Changelog

Sourced from starlight-blog's changelog.

0.29.0

Minor Changes

  • #225 6449901 Thanks @​HiDeoo! - Improves the generated blog markup to provide more consistent CSS selectors for custom styling and theming.

    ⚠️ Potentially breaking change: If you have custom CSS targeting generated blog markup, you may want to double check the visual appearance of the generated pages when updating.

Commits

Updates starlight-links-validator from 0.25.2 to 0.25.3

Release notes

Sourced from starlight-links-validator's releases.

starlight-links-validator@0.25.3

Patch Changes

Changelog

Sourced from starlight-links-validator's changelog.

0.25.3

Patch Changes

Commits

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

@dependabot
build(deps): bump the website-minor-patch group across 1 directory wi…
b080119 
…th 9 updates

Bumps the website-minor-patch group with 9 updates in the /website directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.2` | `6.0.5` |
| [@astrojs/sitemap](https://github.com/withastro/astro/tree/HEAD/packages/integrations/sitemap) | `3.7.3` | `3.7.4` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.7` | `0.41.10` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.7` | `2.5.11` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.0` | `7.2.10` |
| [starlight-blog](https://github.com/HiDeoo/starlight-blog/tree/HEAD/packages/starlight-blog) | `0.28.0` | `0.29.0` |
| [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.2` | `0.25.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |



Updates `@astrojs/react` from 6.0.2 to 6.0.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.5/packages/integrations/react)

Updates `@astrojs/sitemap` from 3.7.3 to 3.7.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/sitemap/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/sitemap@3.7.4/packages/integrations/sitemap)

Updates `@astrojs/starlight` from 0.41.7 to 0.41.10
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.10/packages/starlight)

Updates `@biomejs/biome` from 2.5.7 to 2.5.11
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.11/packages/@biomejs/biome)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `astro` from 7.2.0 to 7.2.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.10/packages/astro)

Updates `starlight-blog` from 0.28.0 to 0.29.0
- [Release notes](https://github.com/HiDeoo/starlight-blog/releases)
- [Changelog](https://github.com/HiDeoo/starlight-blog/blob/main/packages/starlight-blog/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-blog/commits/starlight-blog@0.29.0/packages/starlight-blog)

Updates `starlight-links-validator` from 0.25.2 to 0.25.3
- [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases)
- [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.3/packages/starlight-links-validator)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: "@astrojs/sitemap"
  dependency-version: 3.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: astro
  dependency-version: 7.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: starlight-blog
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: website-minor-patch
- dependency-name: starlight-links-validator
  dependency-version: 0.25.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: website-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependabot Dependency updates from Dependabot deps Dependency updates or dependency-related work labels Sep 4, 2026
@dependabot
dependabot Bot requested a review from tajemniktv as a code owner September 4, 2026 04:34
@dependabot dependabot Bot added website Website changes deps Dependency updates or dependency-related work dependabot Dependency updates from Dependabot labels Sep 4, 2026
semgrep-code-tajemniktv[bot]
semgrep-code-tajemniktv Bot reviewed Sep 4, 2026
View reviewed changes
Comment thread website/package.json
"tailwindcss": "^4.2.4",
"typescript": "^6.0.3",
"vite": "^8.2.1"
"vite": "^8.2.2"

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a development dependency in a package.json file using caret (^) version ranges, which is standard practice in Node.js projects. The project uses an 'overrides' section and likely has a package-lock.json file (as is standard) that locks dependencies to exact versions in production, mitigating dependency confusion risks. The LOW confidence rating and standard development workflow make this a false positive.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

semgrep-code-tajemniktv[bot]
semgrep-code-tajemniktv Bot reviewed Sep 4, 2026
View reviewed changes
Comment thread website/package.json
"starlight-blog": "^0.29.0",
"starlight-image-zoom": "^0.15.0",
"starlight-links-validator": "^0.25.2",
"starlight-links-validator": "^0.25.3",

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This low-confidence rule is matching a normal semver range in package.json, not evidence of an exploitable vulnerability in application code. Using a caret version for a public dependency is common and this finding alone does not meaningfully improve security without additional supply-chain risk context.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

semgrep-code-tajemniktv[bot]
semgrep-code-tajemniktv Bot reviewed Sep 4, 2026
View reviewed changes
Comment thread website/package.json
"@types/react-dom": "^19.2.4",
"astro": "^7.2.0",
"@types/react-dom": "^19.2.5",
"astro": "^7.2.10",

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a low-confidence dependency version pinning finding in package.json, and the matched caret range is standard package manager usage rather than a directly exploitable issue by itself. Without evidence that installs occur without a lockfile or from an untrusted registry, this does not meaningfully indicate a security vulnerability.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

semgrep-code-tajemniktv[bot]
semgrep-code-tajemniktv Bot reviewed Sep 4, 2026
View reviewed changes
Comment thread website/package.json
"react": "^19.2.8",
"react-dom": "^19.2.8",
"starlight-blog": "^0.28.0",
"starlight-blog": "^0.29.0",

@semgrep-code-tajemniktv semgrep-code-tajemniktv Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

starlight-blog uses the floating range ^0.29.0, allowing later compatible releases to enter developer and CI builds. A hijacked matching release could execute during installation or the Astro build and expose source code or deployment secrets.

More details about this

starlight-blog is declared as ^0.29.0, so package installation can select newer 0.x releases allowed by npm's caret range rather than always using 0.29.0. If a later matching release of starlight-blog were hijacked or published with malicious code, an attacker could exploit the normal dependency installation flow:

  1. An attacker publishes a compromised compatible starlight-blog release, such as 0.29.1.
  2. A developer or CI job runs npm install while resolving the dependencies in this package.json; the ^0.29.0 range permits npm to select that newer release.
  3. The malicious package executes during installation or is included in the Astro build, potentially reading CI environment variables, source files, or deployment credentials and sending them to an attacker-controlled server.
  4. Other developers or build agents that install the project later may resolve a different starlight-blog version, making the dependency behavior and resulting build inconsistent across environments.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
"starlight-blog": "^0.29.0",
"starlight-blog": "0.29.0",
View step-by-step instructions

  1. Pin starlight-blog to the exact version by changing the entry to "starlight-blog": "0.29.0".

  2. Update the npm lockfile to record this exact version and its resolved integrity data with $ npm install --save-exact starlight-blog@0.29.0.

  3. Keep the generated package-lock.json alongside package.json so future installs use the reviewed dependency version.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

You can view more details about this finding in the Semgrep AppSec Platform.

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 7, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/website/dev/website-minor-patch-8414d1310a branch September 7, 2026 04:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@semgrep-code-tajemniktv semgrep-code-tajemniktv[bot] semgrep-code-tajemniktv[bot] left review comments
@tajemniktv tajemniktv Awaiting requested review from tajemniktv tajemniktv is a code owner

Assignees

@tajemniktv tajemniktv

Labels

dependabot Dependency updates from Dependabot deps Dependency updates or dependency-related work size/size:xl website Website changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tajemniktv