From 51fa801edba981b12038afabaf4935a1f3508af3 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 12 Sep 2026 15:14:10 +0000 Subject: [PATCH] Bump svgo to 3.3.5 in the docs site to fix GHSA-w27v-7q3p-w38r The docs site pulled svgo 3.3.4 transitively through @svgr/plugin-svgo and postcss-svgo. That version's removeScripts plugin missed namespace-prefixed anchors () and URL schemes containing embedded tabs, line feeds, or carriage returns (java script:), so executable links could survive optimization. Pin svgo to ^3.3.5 with an override, alongside the existing minimatch, serialize-javascript, and uuid pins, so the patched version stays in place as the transitive ranges (^3.0.2 and ^3.2.0) continue to resolve. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01ELjK1ZcXrvTuv59mkf4d9S --- src/CrestApps.Core.Docs/package-lock.json | 6 +++--- src/CrestApps.Core.Docs/package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/CrestApps.Core.Docs/package-lock.json b/src/CrestApps.Core.Docs/package-lock.json index 06bf5bb9..7ed03b28 100644 --- a/src/CrestApps.Core.Docs/package-lock.json +++ b/src/CrestApps.Core.Docs/package-lock.json @@ -18533,9 +18533,9 @@ "license": "MIT" }, "node_modules/svgo": { - "version": "3.3.4", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/svgo/-/svgo-3.3.4.tgz", - "integrity": "sha1-/SqhD/WFs70rg842AvVYK8Bxi7U=", + "version": "3.3.5", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.5.tgz", + "integrity": "sha512-8SQMzdrvWaD8deUmrnYB+ASyxBVgWUOilg+A75nE/76WdLpj6LopCwiAVvkzkcqy/9b7t2Mg7faFLjg0ZRcZ3w==", "license": "MIT", "dependencies": { "commander": "^7.2.0", diff --git a/src/CrestApps.Core.Docs/package.json b/src/CrestApps.Core.Docs/package.json index a73df8d7..5bb1ad4a 100644 --- a/src/CrestApps.Core.Docs/package.json +++ b/src/CrestApps.Core.Docs/package.json @@ -46,6 +46,7 @@ "overrides": { "minimatch": "^10.0.1", "serialize-javascript": "^7.0.3", + "svgo": "^3.3.5", "uuid": "^11.1.1" } }