Evidence
npm ci on main at a85b909 reports three low-severity audit entries which are one dependency chain:
- direct
@sveltejs/kit 2.70.3;
- direct
@sveltejs/adapter-static 3.0.10, affected through Kit;
- transitive
cookie 0.6.0, affected by GHSA-pxg6-pf52-xh8x (cookie accepts out-of-bounds characters in cookie name, path, and domain).
npm audit --json reports no moderate, high, or critical findings. The suggested automated fix incorrectly proposes old semver-major package versions (@sveltejs/kit 0.0.30 or adapter-static 0.0.17), so npm audit fix --force is not an acceptable remedy. Consolebook uses SvelteKit only to build a static SPA; Rust/Axum owns runtime cookies.
Outcome
Evaluate the first compatible Kit release or a safe lockfile/override update that carries cookie >=0.7.0, confirm the static-build threat boundary, and run npm ci, npm audit, npm run check, npm run build, the Rust gates, and browser tests before merging. Do not suppress the advisory without a documented reason.
Evidence
npm cion main at a85b909 reports three low-severity audit entries which are one dependency chain:@sveltejs/kit2.70.3;@sveltejs/adapter-static3.0.10, affected through Kit;cookie0.6.0, affected by GHSA-pxg6-pf52-xh8x (cookieaccepts out-of-bounds characters in cookie name, path, and domain).npm audit --jsonreports no moderate, high, or critical findings. The suggested automated fix incorrectly proposes old semver-major package versions (@sveltejs/kit0.0.30 or adapter-static 0.0.17), sonpm audit fix --forceis not an acceptable remedy. Consolebook uses SvelteKit only to build a static SPA; Rust/Axum owns runtime cookies.Outcome
Evaluate the first compatible Kit release or a safe lockfile/override update that carries
cookie>=0.7.0, confirm the static-build threat boundary, and runnpm ci,npm audit,npm run check,npm run build, the Rust gates, and browser tests before merging. Do not suppress the advisory without a documented reason.