[supabase-cli-releaser]

Pins packages/stack/src/Artifacts.ts to the
mailpit v1.30.2
slim-services release and its image digest.

Opened from the mirror-slim-image dispatch. artifactFor derives the
native release tag, asset names, and URLs from service + version, so this
pin is the whole change.

[depthfirst-app]

🟡 Severity: MEDIUM

Mailpit v1.30.2 in this newly immutable digest is affected by GHSA-8r62-w5wh-fc5m. A malicious website can request /%61pi/events on a local unauthenticated Mailpit instance, bypass origin validation, and receive stored emails—including password-reset tokens—over the WebSocket.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade Mailpit from v1.30.2 to v1.30.6 (or later) to resolve the CSRF/WebSocket origin-validation bypass described in GHSA-8r62-w5wh-fc5m. The recommended approach is to re-trigger the mirror-slim-image workflow dispatch targeting Mailpit v1.30.6, which will automatically compute the correct image digest and open a new pin PR. Alternatively, update manually: (1) change line 125 from "v1.30.2" to "v1.30.6", and (2) change line 126 to "ghcr.io/supabase/cli/mailpit:v1.30.6@sha256:<correct-digest-for-v1.30.6>", where the digest is obtained by pulling ghcr.io/supabase/cli/mailpit:v1.30.6 and inspecting its manifest digest via docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/supabase/cli/mailpit:v1.30.6 or the GHCR API.