soames-gatsby-theme 0.1.3 → 0.1.4

package/README.md

@@ -18,14 +18,20 @@ npm install soames-gatsby-theme
 
 ## Known Security Notices
 
-During installation, you may encounter audit warnings for two high-severity vulnerabilities related to the cookie and path-to-regexp packages. These packages are used internally by Gatsby’s development tooling, specifically:
+After installation, `npm audit` will report a number of vulnerabilities. All remaining issues fall into two categories:
 
-cookie is included via express and socket.io, which Gatsby uses for its hot-reloading dev server.
+**Gatsby dev-server tooling** — packages used only during local development (`gatsby develop`) and not included in the production static build:
 
-path-to-regexp is also included by express and only used during local development.
+- `cookie`, `path-to-regexp` — used by express and socket.io for Gatsby’s hot-reloading dev server
+- `@parcel/reporter-dev-server` — Gatsby’s internal build tooling
+- `webpack`, `serialize-javascript` — bundler used at build time, not present in the output
+- `tmp` — used by CLI tooling (inquirer) internal to Gatsby’s dependency tree
 
-These dependencies are not included in the production build of your site. Gatsby generates static HTML, CSS, and JS files that do not use these server-side tools.
+**Build-time data-fetching dependencies** — packages used to pull content from WordPress at build time and not included in the deployed site:
 
-As of this version, these issues do not pose a risk to end users or affect the final deployed site. They will be resolved in future versions as Gatsby and its related plugins are updated.
+- `showdown` — pulled in by `@wordpress/blocks` for block rendering; no upstream fix available as of this version
+- `file-type`, `uuid` — used by `gatsby-source-wordpress` for media processing and internal queuing
 
-You can safely ignore these warnings unless you're modifying or redistributing the Gatsby development server code itself.
+Gatsby generates static HTML, CSS, and JS files. None of the packages above are included in your deployed site or exposed to end users.
+
+These issues cannot be resolved without breaking changes to core Gatsby dependencies and will be addressed in future versions as Gatsby and its plugins are updated. You can safely ignore these warnings unless you are modifying or redistributing the Gatsby development tooling itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "soames-gatsby-theme",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A customizable Gatsby theme for personal websites using WordPress as a headless CMS.",
   "main": "dist/gatsby-config.js",
   "scripts": {