From b271c526767b97894d343dcd89bd083f427b7f44 Mon Sep 17 00:00:00 2001 From: Oto Macenauer Date: Sun, 18 Oct 2026 09:09:18 +0200 Subject: [PATCH 1/2] fix: bump fast-uri and source-map-js to clear npm audit source-map-js 1.2.2 fixes GHSA-68fv-2mgg-jv7q (high), fast-uri 3.1.8 fixes GHSA-hrr3-gc8f-f4qj (moderate). Both transitive; lockfile only. --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index ba8b0cc..51cc2cf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4523,8 +4523,8 @@ } }, "node_modules/fast-uri": { - "version": "3.1.7", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.8", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", @@ -6676,8 +6676,8 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0" From f3b24f1b2131edad518193a5e718724b6848ffce Mon Sep 17 00:00:00 2001 From: Oto Macenauer Date: Mon, 19 Oct 2026 09:48:56 +0200 Subject: [PATCH 2/2] ci: stop the image job downloading the wrong dist artifact The reusable build workflow's dry run also uploads an artifact named `dist`, built without the mermaid fixture. The image job intermittently downloaded that one and the container CSP/mermaid tests got a 404 for mermaid.min.js. Name the CI artifact `ci-dist` so the two cannot collide. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f9176fe..10fa709 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -67,7 +67,7 @@ jobs: - name: Upload dist artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: dist + name: ci-dist path: dist/ retention-days: 7 @@ -223,7 +223,7 @@ jobs: - name: Download dist artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: - name: dist + name: ci-dist path: dist # Also proves the Dockerfile's dist/ sanity checks pass on a real build. - name: Build image