Take the site's dependencies past the four high advisories in its audit

[jmrplens]

What this changes

pnpm audit --audit-level=high in site/ (the "Site dependency audit" job) fails on every branch with four high advisories that arrived in the advisory database, not in a commit. This takes each one to a patched version with the smallest change that reaches it:

• sharp 0.35.4 to 0.35.5, librsvg CVE-2026-96889 (GHSA-wq5f-xc86-pv6w): a direct dependency, so package.json now asks for ^0.35.5.
• http-cache-semantics 4.2.0 to 4.3.0 (GHSA-ch52-4w7c-c8xp) and source-map-js 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q): every consumer's range already admits the fixed release (Astro asks for ^4.2.0), so pnpm update resolves them again and the lockfile changes nothing else.
• basic-ftp 5.3.1 to 6.2.3 (GHSA-c475-qrg2-pj4r): fixed in 6.2.1 and in no 5.x release, and the one consumer, get-uri, asks for ^5.3.1 up to its latest release (8.0.1), so no parent update reaches a fix. It is an override in site/pnpm-workspace.yaml, written beside the existing ones with its reason. Forcing the major is safe here, unlike brace-expansion's: 6.0.0's only breaking change is that a client refuses a separate transfer host by default, and get-uri calls only Client, access, lastMod, list, downloadTo and close, whose declarations are identical in 5.3.1 and 6.2.3. 6.2.3 also carries the fixes for GHSA-5rfr-xx34-2xxv and GHSA-r4jh-29pc-gfqr, which the project published after 6.2.1. The path is dev-only: pa11y-ci > puppeteer > @puppeteer/browsers > proxy-agent > pac-proxy-agent > get-uri.

The low and moderate findings that remain (dompurify, katex, smol-toml, postcss-selector-parser) are below the level the job fails on and are left alone. Dependabot's #111 also bumps sharp to 0.35.5, among six other minor and patch updates; it fixes none of the other three, so this does not duplicate it, and Dependabot will rebase it after either lands.

This does not make CI green on its own. The two end-to-end tests that fail on main are fixed separately, in the test-only #116, and govulncheck (GO-2026-6617, net/http in Go 1.27.1) stays red: it is out of scope by the author's decision, and nothing here touches the Go toolchain.

How it was checked

• pnpm install --frozen-lockfile then pnpm audit --audit-level=high in site/: before, 4 high (plus the 2 ignored extract-zip ones); after, exit 0 with "3 low | 2 moderate, 2 ignored: 2 high".
• cd site && pnpm run build (93 pages) and every check the CI and docs workflows run on it: check, contrast:check, i18n:check, cards:check, stats:check, figures:check, docs:check, eslint, format:check, html-validate, htmlhint, a11y:check, schema:check, directives:check, twins:check, llms:check, tables:check: all exit 0. pnpm run pa11y: 30/30 URLs passed.
• get-uri and proxy-agent load against basic-ftp 6.2.3 (require of both, and of get-uri's dist/ftp.js).
• go test -count=1 ./internal/render/...: ok (no MDX changed).
• make build vet test-race, make golangci-lint, make check-*: not applicable, no Go change.

What it owes

• No em dash or en dash, and nothing in the repository is in Spanish outside site/src/content/docs/es/.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: jmrplens/ghchronicle/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6a455f28-4af1-4bdc-8be8-55319a9bfa2e

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've found 1 issue

Fixed security issues:

• http-cache-semantics (link)
• sharp (link)
• source-map-js (link)

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="site/pnpm-workspace.yaml" line_range="41" />
<code_context>
+  # list, downloadTo and close, which kept their signatures. 6.2.3 also carries
+  # the fixes for GHSA-5rfr-xx34-2xxv (6.2.2) and GHSA-r4jh-29pc-gfqr (6.2.3).
+  # Lift this once get-uri depends on a fixed basic-ftp itself.
+  "basic-ftp@<6.2.3": 6.2.3
   # 7.3.1 added a pass that moves a <style> element's text into a `set:html`
   # property, and runs it before the pass that collapses static MDX subtrees
</code_context>
<issue_to_address>
**FTP proxy configuration fails**

When an FTP fetch uses a server whose PASV response advertises a transfer host different from its control host, `get-uri` uses `basic-ftp` 6.2.3 without opting in to separate transfer hosts, so the client rejects the advertised host and the FTP fetch fails; PAC loading or proxy resolution fails.

Update the FTP fetch path to opt in to separate transfer hosts.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: site/pnpm-workspace.yaml:41

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🟡 Medium · FTP proxy configuration fails

When an FTP fetch uses a server whose PASV response advertises a transfer host different from its control host, get-uri uses basic-ftp 6.2.3 without opting in to separate transfer hosts, so the client rejects the advertised host and the FTP fetch fails; PAC loading or proxy resolution fails.

Update the FTP fetch path to opt in to separate transfer hosts.

Prompt for AI agents

In `site/pnpm-workspace.yaml` at line 41:

**FTP proxy configuration fails**

When an FTP fetch uses a server whose PASV response advertises a transfer host different from its control host, `get-uri` uses `basic-ftp` 6.2.3 without opting in to separate transfer hosts, so the client rejects the advertised host and the FTP fetch fails; PAC loading or proxy resolution fails.

Update the FTP fetch path to opt in to separate transfer hosts.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jmrplens]

Landed as part of #117, together with #116 and the Go 1.27.2 update: each fixed one part of the required CI check and failed on the others, and this repository only allows squash merges.