Release v2.6.1 — dependency security sweep - #42
Merged
Merged
Conversation
Clears all 15 open advisories against the dependency tree. Every one was an npm package in website-fumadocs (the docs site); none was reachable from the shipped CLI, brain, or remote server. Direct bumps: next 16.2.9 -> 16.2.11 (9 advisories) postcss 8.5.16 -> 8.5.25 Transitive, pinned via overrides since no parent has released a manifest pointing at the patched version yet: sharp 0.34.5 -> 0.35.3 (via next) js-yaml 5.2.0 -> 5.2.3 (via fumadocs-core/-mdx) fast-uri 3.1.3 -> 3.1.5 (via serve -> ajv) brace-expansion 1.1.15 -> 1.1.18 (via serve -> serve-handler -> minimatch) sharp crossing a major (0.34 -> 0.35) is the one bump with real breakage risk, since next uses it for build-time image optimization. Verified with a full `npm run build`: 72 static pages including the /og/docs/**/image.png Open Graph routes, which are the paths that actually exercise sharp. `npm ci` from the regenerated lockfile reports 0 vulnerabilities, types:check passes, and cargo check --workspace --locked is green at 2.6.1. Rust crate sources are byte-identical to v2.6.0 — the only diff under crates/ is the inter-crate version pins. Version bumped with scripts/bump-version.sh so the release.yml version-guard agrees with the tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
website-fumadocs(the docs site), none reachable from the shipped CLI, brain, or remote server.next16.2.9 → 16.2.11 (9 advisories),postcss8.5.16 → 8.5.25.overrides(no parent package has released a manifest pointing at the patched version yet):sharp0.34.5 → 0.35.3 (via next),js-yaml5.2.0 → 5.2.3 (via fumadocs-core/-mdx),fast-uri3.1.3 → 3.1.5 (via serve → ajv),brace-expansion1.1.15 → 1.1.18 (via serve → serve-handler → minimatch).Test plan
npm cifrom the regenerated lockfile reports 0 vulnerabilities (npm audit --omit=dev)npm run buildsucceeds (72 static pages, including the/og/docs/**/image.pngOpen Graph routes that exercisesharp)types:checkpassescargo check --workspace --lockedgreen at 2.6.1 (Rust crate sources unchanged from v2.6.0 — only inter-crate version pins differ)🤖 Generated with Claude Code