[supabase-cli-releaser]

Pins packages/stack/src/Artifacts.ts to the
mailpit v1.30.2
slim-services release and its image digest.

Opened from the mirror-slim-image dispatch. artifactFor derives the
native release tag, asset names, and URLs from service + version, so this
pin is the whole change.

[depthfirst-app]

🟡 Severity: MEDIUM

The pinned Mailpit v1.30.2 image is affected by GHSA-8r62-w5wh-fc5m. A malicious website can send /%61pi/events to the default unauthenticated Mailpit endpoint; routing reaches /api/events while origin validation is skipped, streaming captured email metadata and body snippets, including password-reset tokens, cross-origin. GHSA-8r62-w5wh-fc5m
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade the pinned Mailpit image from v1.30.2 to v1.30.6 or later, which patches GHSA-8r62-w5wh-fc5m. Update both the version string (line 125) and the image URI with the new tag and its corresponding SHA256 digest (line 126). You can retrieve the correct digest for the patched image by running: docker pull ghcr.io/supabase/cli/mailpit:v1.30.6 && docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/supabase/cli/mailpit:v1.30.6. Replace the current v1.30.2 version and digest with the values from v1.30.6 (or the latest patched release >= v1.30.6).