fix: upgrade adm-zip to 0.6.0 (CVE-2026-39244) - #626
Open
anupamme wants to merge 86 commits into
Open
Conversation
Bumps [cssnano-preset-advanced](https://github.com/cssnano/cssnano) from 7.0.12 to 7.0.13. - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/cssnano-preset-advanced@7.0.12...cssnano-preset-advanced@7.0.13) --- updated-dependencies: - dependency-name: cssnano-preset-advanced dependency-version: 7.0.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [globals](https://github.com/sindresorhus/globals) from 17.4.0 to 17.5.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.4.0...v17.5.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.5.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
ci: update Install Dart Sass step to use direct binary download
…rn/cssnano-preset-advanced-7.0.13 build(deps): bump cssnano-preset-advanced from 7.0.12 to 7.0.13
Bumps [stylelint](https://github.com/stylelint/stylelint) from 17.6.0 to 17.7.0. - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.6.0...17.7.0) --- updated-dependencies: - dependency-name: stylelint dependency-version: 17.7.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/globals-17.5.0 build(deps-dev): bump globals from 17.4.0 to 17.5.0
Bumps [hugo-extended](https://github.com/jakejarvis/hugo-extended) from 0.159.2 to 0.160.1. - [Commits](jakejarvis/hugo-extended@v0.159.2...v0.160.1) --- updated-dependencies: - dependency-name: hugo-extended dependency-version: 0.160.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/stylelint-17.7.0 build(deps-dev): bump stylelint from 17.6.0 to 17.7.0
…rn/hugo-extended-0.160.1 build(deps): bump hugo-extended from 0.159.2 to 0.160.1
Bumps [eslint](https://github.com/eslint/eslint) from 10.1.0 to 10.2.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.1.0...v10.2.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Update Hugo module dependencies
…rn/eslint-10.2.0 build(deps-dev): bump eslint from 10.1.0 to 10.2.0
Bumps [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) from 0.22.0 to 0.22.1. - [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md) - [Commits](DavidAnson/markdownlint-cli2@v0.22.0...v0.22.1) --- updated-dependencies: - dependency-name: markdownlint-cli2 dependency-version: 0.22.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [gethinode/create-pull-request](https://github.com/gethinode/create-pull-request) from 7 to 8. - [Release notes](https://github.com/gethinode/create-pull-request/releases) - [Commits](gethinode/create-pull-request@v7...v8) --- updated-dependencies: - dependency-name: gethinode/create-pull-request dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…ions/gethinode/create-pull-request-8 build(deps): bump gethinode/create-pull-request from 7 to 8
…rn/markdownlint-cli2-0.22.1 build(deps-dev): bump markdownlint-cli2 from 0.22.0 to 0.22.1
Bumps [cssnano](https://github.com/cssnano/cssnano) from 7.1.4 to 7.1.9. - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/cssnano@7.1.4...cssnano@7.1.9) --- updated-dependencies: - dependency-name: cssnano dependency-version: 7.1.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/cssnano-7.1.7 build(deps): bump cssnano from 7.1.4 to 7.1.9
Bumps [eslint](https://github.com/eslint/eslint) from 10.2.0 to 10.3.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.2.0...v10.3.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [cssnano-preset-advanced](https://github.com/cssnano/cssnano) from 7.0.13 to 7.0.16. - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/cssnano-preset-advanced@7.0.13...cssnano-preset-advanced@7.0.16) --- updated-dependencies: - dependency-name: cssnano-preset-advanced dependency-version: 7.0.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/commitlint/cli-20.5.3 build(deps-dev): bump @commitlint/cli from 20.5.0 to 20.5.3
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.13 to 7.5.19. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.19) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/tar-7.5.16 build(deps): bump tar from 7.5.13 to 7.5.19
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.9.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.9.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.8.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/shell-quote-1.8.4 build(deps-dev): bump shell-quote from 1.8.3 to 1.9.0
…rn/brace-expansion-5.0.6 build(deps): bump brace-expansion from 5.0.5 to 5.0.6
…rn/globals-17.6.0 build(deps-dev): bump globals from 17.5.0 to 17.6.0
Update Hugo module dependencies
Bumps [stylelint](https://github.com/stylelint/stylelint) from 17.8.0 to 17.14.0. - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.8.0...17.14.0) --- updated-dependencies: - dependency-name: stylelint dependency-version: 17.11.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/stylelint-17.11.0 build(deps-dev): bump stylelint from 17.8.0 to 17.14.0
Bumps [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) from 20.5.0 to 21.2.0. - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.0/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/config-conventional" dependency-version: 20.5.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…rn/hugo-extended-0.161.1 build(deps): bump hugo-extended from 0.160.1 to 0.161.1
…nventional-20.5.3
…rn/commitlint/config-conventional-20.5.3 build(deps-dev): bump @commitlint/config-conventional from 20.5.0 to 21.2.0
Bump hinode v2 -> v3 (v3.0.0) and every Hugo module this template pins directly to its v6-generation release: mod-utils v6.3.0, mod-blocks v2.0.1, mod-fontawesome v6.0.0, mod-flexsearch v5.0.0, mod-leaflet v3.0.0, mod-lottie v3.0.0, mod-mermaid v5.0.0, and mod-simple-datatables v4.0.0. Import paths in config/_default/hugo.toml follow the same bump; mod-blocks stays first and hinode stays last, matching the existing import order. mod-bootstrap, mod-csp, mod-katex, and mod-google-analytics do not depend on mod-utils, so they were left alone; hugo mod tidy picked up their latest available patch releases as a side effect. Rendered-output deltas for this generation (defaults now apply to section-title, hero, and illustration widths) are documented in the hinode v3 release notes: https://github.com/gethinode/hinode/releases/tag/v3.0.0 Verified with hugo mod vendor and npm run build: exit 0, zero ERROR lines, and zero "Invalid arguments" warnings against this site's minimal starter content. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat: adopt hinode v3 (mod-utils v6 generation)
Bump hinode v3.0.0 -> v3.6.0 (S1-S3 styles pipeline) and align the starter: - Replace config/postcss.config.js with the current hinode baseline (purge-first order purgecss -> autoprefixer -> cssnano default; drop cssnano-preset-advanced). - Pin Bootstrap 5.3.8's browserslist in package.json for autoprefixer. - Drop the now-redundant explicit style.purge = true (v3.6.0 defaults it on). - Stop committing hugo_stats.json and gitignore it (build.buildStats regenerates it). Fresh-site build: green, purged CSS served (main.css 198 KB, autoprefixer prefixes present), no purge/postcss warnings, run-vs-run deterministic.
… < 0.164) The starter deploys with Hugo 0.158/0.161, where mod-flexsearch v5.1.0's templates.Defer search index collides with the theme's resources.PostProcess and leaks a raw __hdeferred token into the navbar search box. mod-flexsearch v5.1.1 version-gates that (eager publish on Hugo < 0.164); hinode v3.6.1 adds the sidebar cycle guard. _vendor is gitignored, so the deploy vendors these from go.mod at build time. Fresh-site build on Hugo 0.161: 0 __hdeferred leaks, search index published, purged CSS served (main.css 198 KB), green.
feat: adopt the purged-by-default styles pipeline (hinode v3.6.0)
Bump hinode v3.6.1 -> v3.7.0 (js-pipeline modernization): first-party theme JS is now ESM bundled via js.Build (mod-utils v6.7.0 bundlev3); the bundlev2 concat lane still serves optional modules and user-site custom JS. Transitive module updates pulled by the bump: mod-utils v6.7.0, mod-katex v1.1.7, mod-leaflet v3.1.3, mod-lottie v3.0.4, mod-mermaid v5.0.4. Align the starter with the new pipeline: - Remove the leftover keepVarNames = true override from [minify.tdewolff.js]; it would silently disable the identifier mangling v3.7.0 enables. - Gitignore the js.Build-generated assets/jsconfig.json (mirrors hinode main). Fresh-site build on Hugo 0.161: zero errors, core bundle emitted without the .min infix (core.bundle.en.<hash>.js, 149 KB, mangled identifiers) plus the ESM module variant, both referenced with SRI integrity + defer; lint green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat: adopt hinode v3.7.0 with the js.Build script pipeline
Netlify installed Hugo 0.158.0 on every build and then never used it. The build invokes `hugo` from an npm script, which resolves to node_modules/.bin/hugo provided by the hugo-extended dependency, so the binary Netlify downloads for HUGO_VERSION is discarded. The pin therefore only created drift between the version anyone reading the Netlify config would trust and the binary that actually ran, plus a pointless download on every build. package.json remains the single pin. Remove the key from data/netlify.toml, the real source: netlify.toml is generated from it and carries a do-not-modify header. The generated output is regenerated to match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…rsion-pin fix: drop the dead HUGO_VERSION pin from the Netlify config
Automated dependency upgrade by OrbisAI Security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade adm-zip from 0.5.17 to 0.6.0 to fix CVE-2026-39244.
Vulnerability
CVE-2026-39244package-lock.json(dependency:adm-zip)Description: adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation
Evidence
Scanner confirmation: trivy rule
CVE-2026-39244flagged this pattern.Changes
package.jsonpackage-lock.jsonBehavior Preservation
The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security