@prenta/core 0.120.1 → 0.120.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,40 @@
|
|
|
1
1
|
# @actuate-media/cms-core
|
|
2
2
|
|
|
3
|
+
## 0.120.2
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 7f60722: Patch four runtime dependency advisories
|
|
8
|
+
|
|
9
|
+
Eight open Dependabot alerts, all **runtime** scope, two of them high:
|
|
10
|
+
|
|
11
|
+
| Package | Sev | Was | Now |
|
|
12
|
+
| --------------- | ------ | ------- | ------ |
|
|
13
|
+
| `ip-address` ×3 | high | 10.2.0 | 10.4.0 |
|
|
14
|
+
| `fast-uri` | high | 3.1.4 | 3.1.5 |
|
|
15
|
+
| `undici` ×3 | medium | 6.27.0 | 6.28.0 |
|
|
16
|
+
| `hono` | medium | 4.12.27 | 4.13.0 |
|
|
17
|
+
|
|
18
|
+
**A different failure from the last batch.** The brace-expansion fix corrected
|
|
19
|
+
override _keys_ whose ranges no longer selected the resolved version. Here every
|
|
20
|
+
caret range already permitted the patched release — `^3.1.2` allows 3.1.5 — and
|
|
21
|
+
the lockfile simply had not moved. Raising each floor to the advisory's patched
|
|
22
|
+
version forces resolution and leaves the intent legible in the file: the number
|
|
23
|
+
in the override is now the number the advisory requires, not the number that
|
|
24
|
+
happened to be current when it was written.
|
|
25
|
+
|
|
26
|
+
`undici` had resolved to both 6.27.0 and 6.28.0; only the patched one remains.
|
|
27
|
+
|
|
28
|
+
**The overrides block was audited, not spot-checked.** Every entry was compared
|
|
29
|
+
against what the lockfile actually resolved, allowing for the normal case where
|
|
30
|
+
a package resolves to several majors and each has its own scoped rule. After
|
|
31
|
+
these four, every override is in effect. Two things that audit had to get right
|
|
32
|
+
before its answer meant anything: pnpm echoes the overrides block at the top of
|
|
33
|
+
the lockfile in the same shape as a package entry, so a naive scan reports every
|
|
34
|
+
override key as a resolved version; and an unscoped rule is outranked by any
|
|
35
|
+
scoped rule that selects the same version, so `js-yaml: ^4.2.0` sitting above a
|
|
36
|
+
resolved 3.15.0 is correct rather than stale.
|
|
37
|
+
|
|
3
38
|
## 0.120.1
|
|
4
39
|
|
|
5
40
|
### Patch Changes
|