From f3bbd8d854b09c5db7efd574ebe226d877390e9a Mon Sep 17 00:00:00 2001 From: Thierry Heumann <2956045+theumann@users.noreply.github.com> Date: Mon, 26 Oct 2026 11:59:30 -0700 Subject: [PATCH] Bump http-cache-semantics to 4.3.0 for a high-severity advisory npm audit flagged 4.2.0 (max-stale handling can disclose cross-user cached responses), and Dependabot hadn't opened a PR for it. It's a build-time dependency, so the static site was never exposed. Only the version, resolved URL and integrity change. `npm audit fix` on the local npm (11.1.0) also stripped the lockfile's `libc` fields, which Dependabot's newer npm writes and which pick the glibc or musl build of native packages on Linux, so the bump was applied without that churn. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index d70f16a..e83762d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4116,9 +4116,9 @@ } }, "node_modules/http-cache-semantics": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz", - "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz", + "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==", "license": "BSD-2-Clause" }, "node_modules/inline-style-parser": {