nostr-summary on Nostr: [ hoornet/vega ] deps: fix 4 Dependabot alerts via lockfile bumps - postcss 8.5.15 -> ...
[ hoornet/vega ] deps: fix 4 Dependabot alerts via lockfile bumps
- postcss 8.5.15 -> 8.5.25 (GHSA-r28c-9q8g-f849, high; build-time only via Vite)
- quinn-proto 0.11.14 -> 0.11.16 (GHSA-4w2j-m93h-cj5j, high; lockfile-only, never compiled)
- serde_with 3.18.0 -> 3.21.0 (GHSA-7gcf-g7xr-8hxj, medium; transitive via Tauri)
- dompurify 3.4.11 -> 3.4.12 (GHSA-c2j3-45gr-mqc4, low; CUSTOM_ELEMENT_HANDLING unused)
None practically exploitable in Vega. npm build + cargo check verified.
https://github.com/hoornet/vega/commit/ad4916b3527bf21d2225810fa406be55c195dcb1Published at
2026-08-01 12:01:39 UTCEvent JSON
{
"id": "5874dc365a1874335baf56d63971234b3368b8a4a8708c1d12b25adc53beec90",
"pubkey": "7febe2a59aa826f8f6337b4101939eaac82fd4e6ca5f3c7b8f13ca03ad26f2bf",
"created_at": 1785585699,
"kind": 1,
"tags": [
[
"proxy",
"https://github.com/hoornet/vega/commit/ad4916b3527bf21d2225810fa406be55c195dcb1",
"web"
]
],
"content": "[ hoornet/vega ] deps: fix 4 Dependabot alerts via lockfile bumps\n\n- postcss 8.5.15 -\u003e 8.5.25 (GHSA-r28c-9q8g-f849, high; build-time only via Vite)\n- quinn-proto 0.11.14 -\u003e 0.11.16 (GHSA-4w2j-m93h-cj5j, high; lockfile-only, never compiled)\n- serde_with 3.18.0 -\u003e 3.21.0 (GHSA-7gcf-g7xr-8hxj, medium; transitive via Tauri)\n- dompurify 3.4.11 -\u003e 3.4.12 (GHSA-c2j3-45gr-mqc4, low; CUSTOM_ELEMENT_HANDLING unused)\n\nNone practically exploitable in Vega. npm build + cargo check verified.\nhttps://github.com/hoornet/vega/commit/ad4916b3527bf21d2225810fa406be55c195dcb1",
"sig": "0ca003ad04942c57400ea2f31e0f5d17b6875d59427092c79af51212fdb2ec23dc632ca38cad30d4388d3656080b966c1328373447f2e845770a65e95666e01f"
}
