e460a12550
All twelve Dependabot alerts on main were npm transitive dependencies in two lockfiles, and all were build-time only. Worth saying plainly, because "10 high severity" reads worse than it is: fast-uri, nanoid, postcss, ws and esbuild are dev dependencies of the webpack and remotion toolchains. Nothing here reaches a published package. ClientLib is fixed by a lockfile bump alone. Its dist/*.js is committed and embedded into the assembly, so the check that matters is whether the shipped artifact moved: rebuilding with the patched toolchain reproduces all three files byte for byte, same md5, so it did not. The readme-video project needed @remotion/cli and remotion moved from 4.0.469 to 4.0.516, which npm audit fix could not do on its own because both are exact-pinned. The bump is non-major and carries the ws and esbuild fixes. Both directories now report zero vulnerabilities. Clearing them is mostly about signal: twelve standing alerts is how a real one goes unnoticed. |
||
|---|---|---|
| .. | ||
| artwork | ||
| custom | ||
| icon | ||
| logo | ||
| screenshots | ||
| video | ||
| elsa-workflows-workflow-engine-for-dotnet.png | ||
| github-social-preview-banner-for-elsa.psd | ||
| persistence-vnext-poc.md | ||
| persistence-vnext-roadmap.md | ||
| persistence-vnext-workflow-runtime-evaluation.md | ||
