@koehler8/cms 1.5.1 → 1.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/package.json +3 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.5.2
|
|
4
|
+
|
|
5
|
+
### Security
|
|
6
|
+
|
|
7
|
+
- **Patched `undici` for GHSA-4w7w-5xrc-9h26 and GHSA-xjj6-f33q-929c.**
|
|
8
|
+
`jsdom` (installed through the `vite-ssg` peer) accepts any `undici ^7.21.0`,
|
|
9
|
+
which let sites keep a release below 7.30.1, open to cache poisoning and
|
|
10
|
+
cross-user disclosure via cross-origin redirects, and to a denial of service
|
|
11
|
+
on excessive content-encodings. cms now depends on `undici ^7.30.2` directly,
|
|
12
|
+
so a site that updates cms gets the patched copy. No code in cms imports it.
|
|
13
|
+
|
|
3
14
|
## 1.5.1
|
|
4
15
|
|
|
5
16
|
### Fixed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@koehler8/cms",
|
|
3
|
-
"version": "1.5.
|
|
3
|
+
"version": "1.5.2",
|
|
4
4
|
"description": "Vertex CMS — lightweight, config-driven Vue 3 framework with theming, extensions, and SSG support",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -82,7 +82,8 @@
|
|
|
82
82
|
"ajv-formats": "^3.0.1",
|
|
83
83
|
"fast-uri": "^3.1.9",
|
|
84
84
|
"pinia": "^4.0.3",
|
|
85
|
-
"sharp": "^0.35.3"
|
|
85
|
+
"sharp": "^0.35.3",
|
|
86
|
+
"undici": "^7.30.2"
|
|
86
87
|
},
|
|
87
88
|
"optionalDependencies": {
|
|
88
89
|
"canvas": "^3.2.0",
|