From 59a6dba930a75fee2eba5b59eb5da61a284d05b8 Mon Sep 17 00:00:00 2001 From: Paul <72733450+paul1995tu@users.noreply.github.com> Date: Sun, 6 Sep 2026 14:29:37 +0200 Subject: [PATCH] chore(deps): update vitest and solid-js for two critical advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `bun audit` reported two critical findings on the default branch. vitest 3.2.4 is affected by GHSA-5xrq-8626-4rwp: with the UI server listening, an arbitrary file can be read and executed. Fixed in 3.2.6; this takes 3.2.7, the current patch of that line. Dependabot proposed 3.2.6 for the same finding. seroval 1.5.1 is affected by GHSA-mv8w-475r-vwqw: `seroval.fromJSON()` promise resolver type confusion invokes attacker-controlled methods during deserialization. It reaches the tree through `oxlint-plugin-solid > solid-js > seroval-plugins > seroval`. No override is needed — solid-js already requires `seroval: ~1.5.4`, which is past the affected range, and only the pin at 1.9.11 held the old copy in place. `bun audit` now reports no critical findings, down from two. Verified under the new versions: `release:verify:typebuddy` and `release:verify:simplelog` both exit 0, oxlint-plugin-solid 39 pass / 0 fail. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01CkmW7HzpL6zqpjuo1ETm2w --- package.json | 2 +- packages/oxlint-plugin-solid/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index b0be472..0c0089b 100644 --- a/package.json +++ b/package.json @@ -40,6 +40,6 @@ "oxlint-tsgolint": "^7.0.2001", "tsdown": "0.22.14", "typescript": "^7.0.2", - "vitest": "3.2.4" + "vitest": "3.2.7" } } diff --git a/packages/oxlint-plugin-solid/package.json b/packages/oxlint-plugin-solid/package.json index 8f8c397..06e6bd1 100644 --- a/packages/oxlint-plugin-solid/package.json +++ b/packages/oxlint-plugin-solid/package.json @@ -35,7 +35,7 @@ "style-to-object": "^1.0.8" }, "devDependencies": { - "solid-js": "^1.9.11" + "solid-js": "^1.9.15" }, "publishConfig": { "access": "public",