dangernoodle-io / TaipanMiner / 27077881796

90%

push

github

fix(deps): patch svelte-ecosystem CVEs (svelte>=5.55.7, devalue>=5.8.1) (#515)

resolves 5 Dependabot alerts (1 high, 4 medium):
- devalue DoS via sparse-array deserialization (HIGH) -> 5.8.1
- svelte SSR XSS (spread), DOM-clobbering XSS, ReDoS in <svelte:element>,
  promise-serialization SSR XSS (MEDIUM x4) -> 5.55.7

bumps the direct svelte dep to ^5.56.2 across all four webui packages and
adds pnpm.overrides (svelte>=5.55.7, devalue>=5.8.1) to force the patched
versions through transitive resolution. node_modules now resolves a single
svelte@5.56.2 + devalue@5.8.1; miner build + 1109 tests pass.

2800 of 3479 branches covered (80.48%)

Branch coverage included in aggregate %.

5447 of 5617 relevant lines covered (96.97%)

147051.37 hits per line