mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-16 16:16:32 +03:00
Paul BakausandClaude Fable 5
9f5bbed8b8
The astro-vite7 live-e2e fixture pinned astro ^6.0.0, which resolves into the vulnerable range of three dependabot advisories: GHSA-4g3v-8h47-v7g6 (reflected XSS via View Transition animation properties, medium), GHSA-f48w-9m4c-m7f5 (XSS via spread attribute names in renderHTMLElement, medium), and GHSA-7pw4-f3q4-r2p2 (XSS via transition:* directive values, low). All three are patched by 7.1.0. Dev-only test fixture; the vulnerable code paths (View Transitions, transition directives, spread attributes) are not exercised by this static, non-hydrated page, so real exposure is nil. Bumped anyway as the cheap, correct fix. Also corrected the now-stale fixture label to "Astro 7 + Vite 7". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
35 lines
973 B
JSON
35 lines
973 B
JSON
{
|
|
"name": "Astro 7 + Vite 7",
|
|
"config": {
|
|
"files": ["src/layouts/Layout.astro"],
|
|
"insertBefore": "</body>",
|
|
"commentSyntax": "html"
|
|
},
|
|
"sourceFiles": ["src/layouts/Layout.astro", "src/pages/index.astro", "astro.config.mjs"],
|
|
"generatedFiles": [],
|
|
"wrapCases": [
|
|
{
|
|
"name": "wraps hero in pages/index.astro",
|
|
"args": { "classes": "hero-title", "tag": "h1" },
|
|
"expectedFile": "src/pages/index.astro"
|
|
}
|
|
],
|
|
"runtime": {
|
|
"styling": "plain-css",
|
|
"install": ["npm", "install", "--no-audit", "--no-fund", "--loglevel=error"],
|
|
"devCommand": ["npx", "astro", "dev", "--host", "127.0.0.1"],
|
|
"readyPattern": "Local\\s+https?://[^:\\s]+:(\\d+)",
|
|
"readyTimeoutMs": 180000,
|
|
"probe": {
|
|
"expectLiveInit": true,
|
|
"expectConsoleClean": true
|
|
},
|
|
"steer": {
|
|
"sourceFile": "src/pages/index.astro"
|
|
},
|
|
"missedDoneReloadScenario": {
|
|
"sourceFile": "src/pages/index.astro"
|
|
}
|
|
}
|
|
}
|