ReviewOS

craft-native/craft

Dependency Dashboard

#318
Closed github-actions[bot] opened this 9 days ago ·
github-actions[bot] 9 days ago

This issue lists Buddy Bot updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

[!CAUTION] 60 known vulnerabilities affect 5 dependencies in this repository.

SeverityPackageCurrentAdvisoryFixed in
🟠 Highelectron^33.0.0GHSA-532v-xpq5-8h9539.8.1
🟠 Highelectron^33.0.0GHSA-8337-3p73-46f438.8.6
🟠 Highelectron^33.0.0GHSA-9f4c-93c8-jc8g42.0.1
🟠 Highelectron^33.0.0GHSA-9qh4-3jw8-366w41.10.6
🟠 Highelectron^33.0.0GHSA-9wfr-w7mm-pc7f38.8.6
🟠 Highelectron^33.0.0GHSA-gr2m-v5gq-v68541.10.6
🟠 Highelectron^33.0.0GHSA-h7rp-cf8h-j98x39.8.9
🟠 Highelectron^33.0.0GHSA-hq2x-r82h-9wj441.10.4
🟠 Highelectron^33.0.0GHSA-j84w-jfhq-vhvj41.10.6
🟠 Highelectron^33.0.0GHSA-jjp3-mq3x-295m38.8.6
🟠 Highelectron^33.0.0GHSA-v3j7-r9gq-3gjw42.0.0
🟡 Moderateelectron^33.0.0GHSA-3c8v-cfp5-988538.8.6
🟡 Moderateelectron^33.0.0GHSA-4f78-qhmw-8j8m39.8.7
🟡 Moderateelectron^33.0.0GHSA-4p4r-m79c-wq3v38.8.6
🟡 Moderateelectron^33.0.0GHSA-5c9j-mhmv-5xgx42.0.0-beta.1
🟡 Moderateelectron^33.0.0GHSA-5rqw-r77c-jp7938.8.6
🟡 Moderateelectron^33.0.0GHSA-9pf5-hg6p-4pwp39.8.7
🟡 Moderateelectron^33.0.0GHSA-9w97-2464-878338.8.6
🟡 Moderateelectron^33.0.0GHSA-f2r8-jv7c-xqmp39.8.9
🟡 Moderateelectron^33.0.0GHSA-f3pv-wv63-48x839.8.5
🟡 Moderateelectron^33.0.0GHSA-ff2p-hmqr-hxm439.8.9
🟡 Moderateelectron^33.0.0GHSA-jm7p-cc5g-qwxx39.8.8
🟡 Moderateelectron^33.0.0GHSA-m55f-7gqj-fr9839.8.8
🟡 Moderateelectron^33.0.0GHSA-mwmh-mq4g-g6gr38.8.6
🟡 Moderateelectron^33.0.0GHSA-p2rr-rvmm-c5fp39.8.8
🟡 Moderateelectron^33.0.0GHSA-r5p7-gp4j-qhrx38.8.6
🟡 Moderateelectron^33.0.0GHSA-v64r-4m7r-3mvq39.8.8
🟡 Moderateelectron^33.0.0GHSA-v93f-fgjr-hjrj39.8.8
🟡 Moderateelectron^33.0.0GHSA-vmqv-hx8q-j7mg35.7.5
🟡 Moderateelectron^33.0.0GHSA-vv43-5jgx-7qv839.8.10
🟡 Moderateelectron^33.0.0GHSA-xj5x-m3f3-5x3h38.8.6
🟡 Moderateelectron^33.0.0GHSA-xwr5-m59h-vwqr38.8.6
⚪ Lowelectron^33.0.0GHSA-8x5q-pvf5-64mp39.8.5
⚪ Lowelectron^33.0.0GHSA-9899-m83m-qhpj38.8.6
⚪ Lowelectron^33.0.0GHSA-f37v-82c4-4x6439.8.5
⚪ Lowelectron^33.0.0GHSA-jfqx-fxh3-c62j38.8.6
⚪ Lowelectron^33.0.0GHSA-pfmc-3mgc-p6fp39.8.10
⚪ Lowelectron^33.0.0GHSA-x8rc-wpg4-grpf39.8.8
🟡 Moderatesvelte^4.0.0GHSA-8266-84wp-wv5c4.2.19
🟡 Moderatesvelte^4.0.0GHSA-crpf-4hrx-3jrp5.51.5
🟡 Moderatesvelte^4.0.0GHSA-f7gr-6p89-r8835.51.5
🟡 Moderatesvelte^4.0.0GHSA-m56q-vw4c-c2cp5.51.5
🟡 Moderatesvelte^4.0.0GHSA-phwv-c562-gvmh5.53.5
🟡 Moderatesvelte^4.0.0GHSA-pr6f-5x2q-rwfp5.55.7
🟡 Moderatesvelte^4.0.0GHSA-rcqx-6q8c-2c425.55.7
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte`^3.0.0^4.0.0`
🟡 Moderatesvelte4.2.20GHSA-crpf-4hrx-3jrp5.51.5
🟡 Moderatesvelte4.2.20GHSA-f7gr-6p89-r8835.51.5
🟡 Moderatesvelte4.2.20GHSA-m56q-vw4c-c2cp5.51.5
🟡 Moderatesvelte4.2.20GHSA-phwv-c562-gvmh5.53.5
🟡 Moderatesvelte4.2.20GHSA-pr6f-5x2q-rwfp5.55.7
🟡 Moderatesvelte4.2.20GHSA-rcqx-6q8c-2c425.55.7
⚪ Lowtsup^8.0.0GHSA-3mv9-4h5g-vhg3n/a

Detected dependencies

npm
package.json
  • mitata ^1.0.10
  • @types/bun latest
package.json
  • electron ^33.0.0
package.json
  • electrobun latest
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • @stacksjs/buddy 0.72.56
  • @stacksjs/bumpx ^0.2.25
  • @stacksjs/bunpress ^0.2.13
  • @stacksjs/env ^0.72.50
  • better-dx ^0.2.38
  • buddy-bot ^0.9.17
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • craft-native workspace:*
  • typescript ^5.3.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • craft-native workspace:*
  • @craft-native/ts-maps workspace:*
  • @types/bun ^1.2.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • craft-native workspace:*
  • typescript ^5.0.0
package.json
  • @stacksjs/clapp ^0.2.0
  • @types/bun latest
package.json
  • @stacksjs/clapp ^0.2.0
  • @types/bun ^1.2.0
  • @types/node ^22.0.0
  • better-dx ^0.2.38
package.json
  • @types/bun ^1.2.0
  • ts-maps ^0.3.9
  • very-happy-dom ^0.1.4
package.json
  • vue ^3.5.43
  • tsup ^8.0.0
  • typescript 7.1.0-dev.20261011.1
  • vue ^3.0.0
package.json
package.json
  • svelte ^4.0.0
  • tsup ^8.0.0
  • typescript 7.1.0-dev.20261011.1
  • svelte ^3.0.0 || ^4.0.0
package.json
  • @types/react ^18.2.0
  • react ^18.2.0
  • tsup ^8.0.0
  • typescript 7.1.0-dev.20261011.1
  • react >=16.8.0
package.json
  • craft-native workspace:*
  • @types/bun latest
package.json
package.json
github-actions
.github/workflows/buddy-bot.yml
  • actions/checkout v6
  • oven-sh/setup-bun v2
  • shivammathur/setup-php v2
.github/workflows/binary-size.yml
  • actions/checkout v6
  • pantry-pm/pantry/packages/action ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf
  • actions/cache v5
  • actions/github-script v7
  • actions/upload-artifact v4
.github/workflows/sbom.yml
  • actions/checkout v6
  • oven-sh/setup-bun v2
  • actions/upload-artifact v4
  • anchore/sbom-action v0
  • actions/download-artifact d3f86a106a0bac45b974a628896c90dbdf5c8093
.github/workflows/native-lifecycle.yml
  • actions/checkout v6
  • oven-sh/setup-bun v2
  • actions/upload-artifact v4
.github/workflows/mobile-e2e.yml
  • actions/checkout v6
  • pantry-pm/pantry/packages/action ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf
  • oven-sh/setup-bun v2
  • actions/upload-artifact v4
  • actions/cache v5
  • actions/setup-java v6
  • android-actions/setup-android v4
  • gradle/actions/setup-gradle v6
  • reactivecircus/android-emulator-runner v2
.github/workflows/windows-source-provenance.yml
  • actions/checkout v6
  • pantry-pm/pantry/packages/action d160044a6fe4ad7e8463828f80dfbc55bcdc07d9
.github/workflows/release.yml
  • actions/checkout v6
  • oven-sh/setup-bun v2
  • pantry-pm/pantry/packages/action ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf
  • actions/download-artifact d3f86a106a0bac45b974a628896c90dbdf5c8093
  • actions/upload-artifact v4
  • actions/setup-node v6
.github/workflows/media-cache.yml
  • actions/checkout v6
  • oven-sh/setup-bun v2
  • actions/upload-artifact v7
  • actions/setup-java v6
  • android-actions/setup-android v4
  • gradle/actions/setup-gradle v4
  • reactivecircus/android-emulator-runner v2
.github/workflows/ci.yml
  • actions/checkout v6
  • pantry-pm/pantry/packages/action ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf
  • actions/upload-artifact v4
  • actions/cache v5
  • pantry-pm/pantry/packages/action d160044a6fe4ad7e8463828f80dfbc55bcdc07d9
  • actions/setup-java v6
  • android-actions/setup-android v4
  • gradle/actions/setup-gradle v6
.github/workflows/benchmarks.yml
  • actions/checkout v6
  • pantry-pm/pantry/packages/action ae59a7b7fc5f4e6f7b8041a75e6b5772680bebdf
  • actions/cache v5
  • oven-sh/setup-bun v2
  • actions/cache/restore v4
  • actions/cache/save v4
  • actions/github-script v7
  • actions/upload-artifact v4
dependency-files
deps.yaml
  • bun.sh @1.4.3
  • ziglang.org @0.18.0-dev.146+35accc06e
packages/zig/build.zig.zon
pantry.lock
  • @stacksjs/buddy 0.72.56
  • @stacksjs/bumpx 0.2.23
  • @stacksjs/bunpress 0.2.13
  • @stacksjs/clapp 0.2.13
  • @stacksjs/env 0.72.50
  • @types/bun 1.4.2
  • @types/node 22.20.1
  • @types/react 18.3.31
  • better-dx 0.2.38
  • buddy-bot 0.9.27
  • bun.sh 1.4.3
  • mitata 1.0.34
  • react 18.3.1
  • svelte 4.2.20
  • ts-maps 0.3.23
  • tsup 8.5.1
  • typescript 7.1.0-dev.20261011.1
  • very-happy-dom 0.1.4
  • vue 3.5.43
  • ziglang.org 0.18.0-dev.146_35accc06e
  • Check this box to trigger a request for Buddy Bot to run again on this repository
glennmichael123 9 days ago

The Electron benchmark dependency is now outside the vulnerable release line on main in 1339fdb:\n\n- benchmarks/apps/electron/package.json: ^42.0.1\n- lockfile resolves Electron 42.11.18\n- benchmark audit reports no findings\n- added a regression test so the benchmark cannot drift back to ^33\n\nThe repository-wide scope test remains green: 10 passed / 0 failed. High findings confined to benchmark/tooling paths remain inventory; shipped artifacts are still gated separately.

glennmichael123 9 days ago

Resolved on main in 1339fdb. The Electron benchmark now uses ^42.0.1 (resolved 42.11.18), bun audit is clean for that benchmark, and the SBOM scope regression tests pass. Tooling-only findings remain inventory by design; release artifacts retain the High/Critical gate.

Sign in to comment on this issue.