cosmos-docusaurus-theme 2.1.2 → 2.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +24 -0
  2. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,30 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
7
7
 
8
8
  ---
9
9
 
10
+ ## [2.1.4] — 2026-03-17
11
+
12
+ ### Security
13
+
14
+ - **Dockerfile**: add `apk upgrade --no-cache` (fixes zlib CVE-2026-22184 CRITICAL)
15
+ - **demo**: add overrides for `cross-spawn`, `glob`, `minimatch`, `tar`
16
+ (actual installed versions are patched; overrides force resolution to fixed versions)
17
+ - **`.trivyignore`**: suppress Trivy false positives where nested `package.json`
18
+ version specs are read instead of actual installed (overridden) versions
19
+ - **publish.yml**: pass `trivyignore` path to `trivy-action`
20
+
21
+ ---
22
+
23
+ ## [2.1.3] — 2026-03-17
24
+
25
+ ### Security
26
+
27
+ - **Dockerfile**: base image `node:20.19-alpine3.21` → `node:20.20.1-alpine3.23`
28
+ (fixes CVE-2025-15467 CRITICAL + 4 HIGH in `libcrypto3`/`libssl3`)
29
+ - **demo**: force `serialize-javascript ^7.0.4` via `overrides`
30
+ (fixes HIGH in webpack transitive chain — Docusaurus 3.9 ships vulnerable version)
31
+
32
+ ---
33
+
10
34
  ## [2.1.2] — 2026-03-17
11
35
 
12
36
  ### Fixed
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cosmos-docusaurus-theme",
3
- "version": "2.1.2",
3
+ "version": "2.1.4",
4
4
  "description": "A clean, dark-first Docusaurus theme aligned with the Rackscope Void/Slate design system — CSS-only, IBM Plex Mono + Outfit typography, brand indigo",
5
5
  "keywords": [
6
6
  "docusaurus",