Dependabot #37 (js-yaml, high) and #38/#39 (weasyprint SSRF, medium).
weasyprint 70.0 declares exactly the same requirements as 69.0, so both
hash locks change by the pin and its two hashes only. Every js-yaml
dependent in the desktop lock asks for ^4.1.0, so 4.3.2 satisfies them
without touching package.json.
All seven Dependabot alerts on this repo, all transitive, all development scope:
frontend/package-lock.json
browserslist 4.28.6 -> 4.28.8 (patched 4.28.7, HIGH)
crash / prototype write via untrusted browserslist-stats.json
postcss-selector-parser 6.1.2 -> 6.1.4 (patched 6.1.3, LOW)
denial of service through uncontrolled AST recursion
two nested copies, under postcss-nested and tailwindcss
desktop/electron/package-lock.json
fast-uri 3.1.5 -> 3.1.7 (patched 3.1.6, HIGH x4)
host confusion via percent-encoded scheme normalization; SSRF via
malformed IPv6 normalization; SSRF via repeated hostname percent-decoding;
host confusion via skipped IDN canonicalization
@xmldom/xmldom 0.8.13 -> 0.8.15 (patched 0.8.15, MEDIUM)
XML fragment injection via invalid EntityReference.nodeName
Every parent range already admitted the patched version (autoprefixer wants
browserslist ^4.28.6, postcss-nested/tailwindcss want ^6.1.1 and ^6.1.2, ajv
wants fast-uri ^3.0.1, plist wants @xmldom/xmldom ^0.8.8), so `npm update` on
the named packages was enough and no package.json or override was needed. Both
lock files carry only these bumps plus the transitive tail browserslist pulls
with it (caniuse-lite, electron-to-chromium, node-releases, baseline-browser-
mapping, update-browserslist-db).
The third root copy of postcss-selector-parser stays at 6.0.10: @tailwindcss/
typography pins that exact version, and 6.0.10 sits outside the advisory's
>= 6.1.0, < 6.1.3 range, so it is not affected.
Verified after installing both locks: frontend `npm run build` clean and 617
vitest tests pass; desktop `npm run build`, test-locales (parity verified),
test-backend-resolution, and test-packaging-preparation all pass.
Haozhe Wu