Problem
A fresh bun audit on main reports 13 advisories: 5 high, 7 moderate, and 1 low. No existing issue tracks them.
Affected locked packages:
brace-expansion@2.1.2: two high-severity expansion/DoS advisories through root developer tooling;esbuild@0.27.7: one low-severity Windows development-server file-read advisory throughtsup;nanoid@3.3.15: two high-severity generator loop/DoS advisories through PostCSS;postcss@8.5.16: one high and one moderate source-map file-disclosure/path-traversal advisory;svelte@4.2.20: six moderate SSR/XSS/DOM-clobbering advisories. It is a dev and peer dependency of@craft-native/svelte; published Craft code does not bundle it, but the supported peer range still includes affected consumers.
Most paths are build/dev-only, so exploitability differs, but a release should either update or explicitly document/allowlist each residual advisory. Per repository policy, dependency updates should go through buddy-bot.
This was found during the release-readiness audit following #254, #242, and #220; it is outside those issue lanes.
Suggested acceptance criteria
- Use buddy-bot to refresh direct/tooling dependencies and the lockfile to patched transitive versions where available.
- Decide and document a safe Svelte peer range/migration path; verify SSR consumer fixtures for the framework binding.
- Add
bun audit(or a reviewed severity/allowlist gate) to release verification. - Re-run framework builds, typecheck, Pickier, package-surface checks, and a frozen install.
- Record any advisory intentionally retained, including why it is unreachable in shipped artifacts.