@koehler8/cms 1.5.0 → 1.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/package.json +3 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.5.2
|
|
4
|
+
|
|
5
|
+
### Security
|
|
6
|
+
|
|
7
|
+
- **Patched `undici` for GHSA-4w7w-5xrc-9h26 and GHSA-xjj6-f33q-929c.**
|
|
8
|
+
`jsdom` (installed through the `vite-ssg` peer) accepts any `undici ^7.21.0`,
|
|
9
|
+
which let sites keep a release below 7.30.1, open to cache poisoning and
|
|
10
|
+
cross-user disclosure via cross-origin redirects, and to a denial of service
|
|
11
|
+
on excessive content-encodings. cms now depends on `undici ^7.30.2` directly,
|
|
12
|
+
so a site that updates cms gets the patched copy. No code in cms imports it.
|
|
13
|
+
|
|
14
|
+
## 1.5.1
|
|
15
|
+
|
|
16
|
+
### Fixed
|
|
17
|
+
|
|
18
|
+
- **Provenance names the right commit again.** 1.5.0's npm provenance pointed
|
|
19
|
+
at the commit before its release commit, so npmjs.com showed "Unable to
|
|
20
|
+
fetch the source commit". 1.5.1 has the same contents as 1.5.0, published
|
|
21
|
+
from a run on its own release tag. Nothing for a site to change.
|
|
22
|
+
|
|
3
23
|
## 1.5.0
|
|
4
24
|
|
|
5
25
|
### Changed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@koehler8/cms",
|
|
3
|
-
"version": "1.5.
|
|
3
|
+
"version": "1.5.2",
|
|
4
4
|
"description": "Vertex CMS — lightweight, config-driven Vue 3 framework with theming, extensions, and SSG support",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -82,7 +82,8 @@
|
|
|
82
82
|
"ajv-formats": "^3.0.1",
|
|
83
83
|
"fast-uri": "^3.1.9",
|
|
84
84
|
"pinia": "^4.0.3",
|
|
85
|
-
"sharp": "^0.35.3"
|
|
85
|
+
"sharp": "^0.35.3",
|
|
86
|
+
"undici": "^7.30.2"
|
|
86
87
|
},
|
|
87
88
|
"optionalDependencies": {
|
|
88
89
|
"canvas": "^3.2.0",
|