Skip to content

v0.1.1

Latest
Latest

Choose a tag to compare

View all tags
@FlyOverCoderKY FlyOverCoderKY released this 30 Jul 00:46
· 11 commits to main since this release
v0.1.1
This tag was signed with the committer’s verified signature.
FlyOverCoderKY Fly Over Coder
SSH Key Fingerprint: wJ89oEmkLnUBqbvNL7wjtuWnZpiO0E/a2FHUf3e/w8k
Verified
Learn about vigilant mode.
bc3ac09
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security scan triage (2026-07-29). No public API, runtime dependency, or behavior change.

  • Fixed: pinned the transitive dev-only uuid to ^11.1.1 via a root overrides entry, clearing GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6) from the development tree, with a lockfile regression test so the pin cannot silently regress.
  • Accepted with documented justification: the brace-expansion (GHSA-mh99-v99m-4gvg) and @opentelemetry/core (GHSA-8988-4f7v-96qf) advisories remain, dev-only. Each one's sole patched release is API-incompatible with the tree azurite pins — verified empirically and recorded in docs/securityscan.md so the override is not re-attempted.
  • Disputed, no code change: the "hardcoded storage key" is Microsoft's published Azurite well-known emulator key against 127.0.0.1, and the "unvalidated recipient" arrives only from the host-owned preparation port that SECURITY.md places on the trusted side of the boundary.

npm audit --omit=dev remains 0; npm audit drops from 12 advisories (5 high, 7 moderate) to 9 (5 high, 4 moderate). Also restores npm run format:check, which main was failing.

Assets 2
Loading