Repository navigation
Update vite to clear its security advisories and fix local dev images - #266
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This updates the website's transitive
vitedependency from7.3.3to7.3.6, which clears the two high severity advisories flagged against the repository (GHSA-v6wh-96g9-6wx3andGHSA-fx2h-pf6j-xcff). The bump only toucheswebsite/package-lock.jsonbecauseastroalready allowsvite ^7.3.2, so no change topackage.jsonwas needed andnpm auditnow reports zero vulnerabilities. Both advisories are Windows only, but resolving them keeps the dependency tree clean for everyone.It also fixes broken images when running the site locally with
npm run dev. The canonical logo and screenshot live in the repository's top levelassets/folder and are only copied intowebsite/public/by a prebuild step that previously ran duringnpm run buildalone, soastro devserved 404s for/dux-logo.pngand/dux-screenshot.svg. The build steps are now factored into a sharedprepscript thatdev,start, andbuildall reuse, so the local server and the production build always start from the same assets and can no longer drift.An upgrade to Astro 7 was explored and intentionally left out. The
astro-pagefindintegration that powers the docs search has no Astro 7 compatible release yet, so staying on the current Astro 6 line keeps search working on a supported dependency until that changes.