morningman opened a new pull request, #4478: URL: https://github.com/apache/doris-website/pull/4478
Supersedes #3572 and #3552, whose target versions are not sufficient or not safe: - **postcss** 8.5.3 → 8.5.31. #3572 stopped at 8.5.10, which only fixes GHSA-qx2v-qp2m-jg93; the high arbitrary file read (GHSA-6g55-p6wh-862q), path traversal (GHSA-r28c-9q8g-f849) and the incomplete fix (GHSA-fxqj-rqcc-2cmp) require 8.5.12 / 8.5.18 / 8.5.23. 8.5.31 is the current 8.x release. - **follow-redirects** 1.15.9 → 1.16.1. #3552 targeted 1.16.0, which fixes GHSA-r4q5-vmmm-2653 but introduces two high advisories fixed only in 1.16.1 (CVE-2026-111755, CVE-2026-111756). - **shell-quote** 1.8.2 → 1.12.0 for the `react-dev-utils` path. #4418 updated launch-editor's copy to 1.12.0 but left the `react-dev-utils` copy at 1.8.2; this consolidates both ranges on 1.12.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv). - **nanoid** 3.3.8 → 3.3.20, required by postcss 8.5.31. The change is lockfile-only; `package.json` is unchanged. Validation: - `yarn install --frozen-lockfile --ignore-scripts` passes on top of current master. - `yarn audit` reports no advisories for postcss, follow-redirects, shell-quote or nanoid. - Only `yarn.lock` is changed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
