Skip to content

Commit

Permalink
Vulnerability fix (#1155)
Browse files Browse the repository at this point in the history
A bug in Astro's build process allows any unauthenticated user to read parts
of the server source code.

I've run Astro's global upgrade command that updates Astro and any
integrations because there were no major or minor version bumps.

- [Snyk link](https://app.snyk.io/org/centrapay/project/0cac2371-d4a0-41eb-ac8f-bf4b06c4c075)
- [CVE link](https://www.cve.org/CVERecord?id=CVE-2024-56159)
- [Fixed in release v5.0.8](https://github.com/withastro/astro/releases/tag/astro%405.0.8)

Test plan:
- Confirm site build and previews locally. Check
  - Guides
  - Code blocks
  - API reference
  - Connection pages
  • Loading branch information
tom-blake authored Dec 23, 2024
1 parent 1df10bd commit 75e231c
Show file tree
Hide file tree
Showing 2 changed files with 692 additions and 131 deletions.
8 changes: 4 additions & 4 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,15 @@
"integration": "vitest --watch=false --config vitest.integration.config.js"
},
"devDependencies": {
"@astrojs/markdoc": "0.12.1",
"@astrojs/tailwind": "5.1.3",
"@astrojs/vue": "5.0.1",
"@astrojs/markdoc": "0.12.4",
"@astrojs/tailwind": "5.1.4",
"@astrojs/vue": "5.0.3",
"@babel/eslint-parser": "^7.14.7",
"@eslint/js": "^9.10.0",
"@hbsnow/rehype-sectionize": "^1.0.7",
"@headlessui/vue": "^1.6.0",
"@tailwindcss/typography": "^0.5.15",
"astro": "5.0.3",
"astro": "5.1.1",
"astro-expressive-code": "^0.38.3",
"eslint": "^9.10.0",
"eslint-plugin-astro": "^1.2.4",
Expand Down
Loading

0 comments on commit 75e231c

Please sign in to comment.