joeyr/aufhocker
1
0
Fork 0
Code Issues Pull requests Projects Releases 31 Packages 1 Wiki Activity Actions
31 releases 31 tags
  • v1.7.1 b488e3db3c

    v1.7.1
    All checks were successful
    CI / build-and-test (push) Successful in 1m54s
    Details
    CI / docker-build (push) Successful in 26s
    Details
    Stable

    joeyr released this 2026-07-31 07:09:12 -05:00 | 7 commits to main since this release

    Dependency and lockfile hygiene. No runtime behavior change.

    Fixed

    • Cleared GHSA-mh99-v99m-4gvg (High) in brace-expansion. Pinned to
      ^5.0.9 via the overrides block. The advisory is a DoS through unbounded
      brace expansion; the package is dev-only here, reached solely via
      eslint → minimatch, so it was never present in the production image
      (npm ci --omit=dev) — the exposure was limited to local and CI lint runs.
      An override was required because neither npm audit fix nor
      npm update brace-expansion would move the tree off 5.0.7, despite
      minimatch's ^5.0.5 range permitting 5.0.9. npm audit is now clean.
    • package-lock.json version now tracks package.json. The lockfile still
      recorded 1.5.3 through the 1.6.0 and 1.7.0 releases — the bumps edited only
      the manifest, so the two drifted. Both now read the same version.
    Downloads