#13 · stacks/bunpress

This issue lists Buddy Bot updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

[!CAUTION] 8 known vulnerabilities affect 2 dependencies in this repository.

Severity	Package	Current	Advisory	Fixed in
🟠 High	`markdown-it`	`^14.1.1`	GHSA-gfr2-rv44-r23c	`14.3.3`
🟠 High	`markdown-it`	`^14.1.1`	GHSA-r7fv-28h4-cvq7	`15.0.2`
🟡 Moderate	`markdown-it`	`^14.1.1`	GHSA-253c-mchw-3w2r	`15.0.1`
🟡 Moderate	`markdown-it`	`^14.1.1`	GHSA-6v5v-wf23-fmfq	`14.2.0`
⚪ Low	`markdown-it`	`^14.1.1`	GHSA-vfgh-jcmw-g37q	`14.3.3`
🟡 Moderate	`showdown`	`^2.1.0`	GHSA-22g5-r2x5-97cx	`n/a`
🟡 Moderate	`showdown`	`^2.1.0`	GHSA-cr32-g25g-vxjj	`n/a`
🟡 Moderate	`showdown`	`^2.1.0`	GHSA-rmmh-p597-ppvv	`n/a`

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

fix(deps): update vulnerable dependencies (markdown-it)
chore(deps): update dependency markdown-it to v15 (markdown-it, markdownit, @types/markdown-it, markdown-it/browser, argparse, linkify-it, dist/, dist/browser/, entities, validateLink, normalizeLink, normalizeLinkText, markdown-it/lib/*, markdown-it-deflist, isPunctCharCode, lheading)
chore(deps): update dependency markdown-it to 15.0.0 (markdown-it)
chore(deps): update actions/checkout action to v7 (allow-unsafe-pr-checkout)
chore(deps): update dependency marked to 18.1.3 (marked, markedjs/marked#4152, markedjs/marked#4103, markedjs/marked#4099, markedjs/marked#4153, markedjs/marked#4146, markedjs/marked#4157, markedjs/marked#4128, markedjs/marked#4145, markedjs/marked#4138, markedjs/marked#4135, markedjs/marked#4134, markedjs/marked#4113, markedjs/marked#4115, markedjs/marked#4117, markedjs/marked#4111, markedjs/marked#38, markedjs/marked#112)
chore(deps): update dependency marked to v18 (marked)
chore(deps): update all non-major dependencies (stacksjs/stacks#3123, stacksjs/ts-cloud#187, stacksjs/ts-cloud#188, stacksjs/logsmith#3402)
chore(deps): update dependency typescript to 7.0.2 (typescript)
chore(deps): update all non-major dependencies
Click on this checkbox to rebase all open PRs at once

Capped dependencies

The following packages are held below their latest version by a range declared elsewhere in the dependency tree. Updating this repository cannot move them — the constraint has to be widened where it is declared.

Package	Installed	Reachable	Latest	Capped by
`undici-types`	`8.3.0`	`8.3.0`	`8.12.3`	`@types/node` (`~8.3.0`)
`data-uri-to-buffer`	`6.0.2`	`6.0.2`	`8.0.0`	`ts-gif` (`^6.0.2`)
`@typescript/typescript-linux-x64`	`7.0.2`	`7.0.2`	`7.1.0-dev.20261102.1`	`typescript` (`7.0.2`)
`@stacksjs/desktop`	`0.2.550`	`0.2.550`	`0.70.232`	`@stacksjs/stx` (`0.2.550`)
`@stacksjs/dtsx`	`0.11.10`	`0.11.10`	`0.11.25`	`bun-plugin-dtsx` (`0.11.10`)
`stx-router`	`0.2.550`	`0.2.550`	`0.2.789`	`@stacksjs/stx` (`0.2.550`), `bun-plugin-stx` (`0.2.550`)
`bun-plugin-stx`	`0.2.550`	`0.2.550`	`0.2.789`	`@stacksjs/stx` (`0.2.550`)
`@stacksjs/sanitizer`	`0.2.550`	`0.2.550`	`0.2.789`	`@stacksjs/stx` (`0.2.550`)

Detected dependencies

npm

package.json

@stacksjs/bumpx ^0.2.4
@stacksjs/env ^0.70.371
@stacksjs/gitlint ^0.1.5
@stacksjs/logsmith ^0.2.1
bun-git-hooks ^0.3.1
bun-plugin-dtsx ^0.11.10
bun-types ^1.3.11
pickier ^0.1.68
typescript ^7.0.2

package.json

@cwcss/crosswind ^0.2.16
@stacksjs/clapp ^0.2.0
@stacksjs/stx ^0.2.550
@stacksjs/ts-i18n ^0.1.11
bunfig ^0.15.17
ts-syntax-highlighter ^0.2.14
bun-plugin-dtsx ^0.10.4
typescript ^7.0.2
@stacksjs/ts-cloud ^0.7.51

package.json

bun-plugin-dtsx ^0.10.4
typescript ^7.0.2

package.json

commonmark ^0.31.2
marked ^17.0.4
markdown-it ^14.1.1
micromark ^4.0.2
micromark-extension-gfm ^3.0.0
showdown ^2.1.0
unified ^11.0.5
remark-parse ^11.0.0
remark-gfm ^4.0.1
remark-rehype ^11.1.2
rehype-stringify ^10.0.1
mitata ^1.0.34
@types/commonmark ^0.27.10
@types/markdown-it ^14.1.2
@types/showdown ^2.0.6
markdown-it-task-lists ^2.1.1

github-actions

.github/workflows/buddy-bot.yml

actions/checkout v4
oven-sh/setup-bun v2
shivammathur/setup-php v2

.github/workflows/release.yml

actions/checkout v6
pantry-pm/pantry/packages/action d899150a11cd12157ea360e21f6800a85f900446
stacksjs/action-releaser v1.2.9

.github/workflows/ci.yml

actions/checkout v6
pantry-pm/pantry/packages/action d899150a11cd12157ea360e21f6800a85f900446
aws-actions/configure-aws-credentials e6de054238d6b7531b4efff3b6587d9aade6a06c

dependency-files

deps.yaml

bun.sh @1.3.14

pantry.lock

@cwcss/crosswind 0.2.16
@stacksjs/bumpx 0.2.6
@stacksjs/clapp 0.2.12
@stacksjs/gitlint 0.1.6
@stacksjs/logsmith 0.2.3
@stacksjs/stx 0.2.173
@stacksjs/ts-i18n 0.1.11
bun-git-hooks 0.3.2
bun-plugin-dtsx 0.10.9
bun-types 1.3.14-canary.20260425T142013
bun.sh 1.3.14
bunfig 0.15.17
ts-syntax-highlighter 0.2.14
typescript 7.0.2

Check this box to trigger a request for Buddy Bot to run again on this repository