Skip to content

Dependency updates #27111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kushmanmb wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Dependency updates #27111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2753439
Initial plan
Copilot Mar 27, 2026
27873d9
Merge pull request #13 from kushmanmb-org/copilot/update-all
Kushmanmb Mar 27, 2026
a6968d1
Initial plan
Copilot Mar 31, 2026
edb4cb7
Fix npm audit: Update moment from vulnerable 2.24.0 to 2.29.4
Copilot Mar 31, 2026
99ab468
Merge pull request #17 from kushmanmb-org/copilot/fix-npm-audit-issues
Kushmanmb Mar 31, 2026
d23ea3c
Initial plan
Copilot Mar 31, 2026
fbf3ccf
💡 Added pullable cache image tag
Copilot Mar 31, 2026
9451512
Merge pull request #18 from kushmanmb-org/copilot/cache-pr-5
Kushmanmb Mar 31, 2026
af489fd
Merge branch 'main' into main
Kushmanmb Apr 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -973,6 +973,8 @@ jobs:
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=raw,value=latest,enable={{is_default_branch}}
${{ github.event_name == 'pull_request' && format('type=raw,value=cache-pr-{0}', github.event.pull_request.number) || '' }}
${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=raw,value=cache-main' || '' }}
Copy link
Copy Markdown

@cursor cursor bot Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image tags collide with cache registry refs

Medium Severity

The new cache-main and cache-pr-{0} tags added to the meta-full metadata step use the same names as the cache-to registry refs in the full image build step. Docker's documentation explicitly warns that the cache ref must not be the same as the image push target. When the image is pushed with tag cache-main and the cache is exported to the same tag, one overwrites the other. This can break layer caching for subsequent builds (causing cache misses and slower builds) or cause failures on registries with tag immutability.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit af489fd. Configure here.

Copy link
Copy Markdown

@cursor cursor bot Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bugbot Autofix determined this is a false positive.

Current .github/workflows/ci.yml no longer tags images as cache-main/cache-pr-*, so image push tags and cache-to refs are distinct and do not conflict.

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.

labels: |
org.opencontainers.image.title=Ghost
org.opencontainers.image.description=Ghost production build (server + admin)
Expand Down
2 changes: 1 addition & 1 deletion apps/posts/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
"@tryghost/admin-x-framework": "0.0.0",
"@tryghost/shade": "0.0.0",
"i18n-iso-countries": "7.14.0",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45",
"papaparse": "5.5.3",
"react": "18.3.1",
Expand Down
2 changes: 1 addition & 1 deletion apps/stats/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
"@tryghost/admin-x-framework": "0.0.0",
"@tryghost/shade": "0.0.0",
"i18n-iso-countries": "7.14.0",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45",
"react": "18.3.1",
"react-dom": "18.3.1",
Expand Down
2 changes: 1 addition & 1 deletion ghost/admin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@
"resolutions": {
"ember-basic-dropdown": "6.0.2",
"ember-in-viewport": "4.1.0",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45"
},
"ember": {
Expand Down
4 changes: 2 additions & 2 deletions ghost/core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@
"metascraper-title": "5.45.10",
"metascraper-url": "5.45.10",
"mime-types": "2.1.35",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45",
"multer": "2.0.2",
"mysql2": "3.18.1",
Expand Down Expand Up @@ -273,7 +273,7 @@
"@tryghost/errors": "1.3.8",
"@tryghost/logging": "2.5.0",
"jackspeak": "2.3.6",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45"
},
"nx": {
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@
"@tryghost/errors": "^1.3.7",
"@tryghost/logging": "2.5.0",
"jackspeak": "2.3.6",
"moment": "2.24.0",
"moment": "2.29.4",
"moment-timezone": "0.5.45",
"nwsapi": "2.2.12"
},
Expand Down
8 changes: 4 additions & 4 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26881,10 +26881,10 @@ moment-timezone@0.5.45, moment-timezone@^0.5.23, moment-timezone@^0.5.31, moment
dependencies:
moment "^2.29.4"

moment@2.24.0, moment@2.27.0, moment@2.30.1, moment@^2.10.2, moment@^2.18.1, moment@^2.19.3, moment@^2.27.0, moment@^2.29.4:
version "2.24.0"
resolved "https://registry.yarnpkg.com/moment/-/moment-2.24.0.tgz#0d055d53f5052aa653c9f6eb68bb5d12bf5c2b5b"
integrity sha512-bV7f+6l2QigeBBZSM/6yTNq4P2fNpSWj/0e7jQcy87A8e7o2nAfP/34/2ky5Vw4B9S446EtIhodAzkFCcR4dQg==
moment@2.24.0, moment@2.27.0, moment@2.29.4, moment@2.30.1, moment@^2.10.2, moment@^2.18.1, moment@^2.19.3, moment@^2.27.0, moment@^2.29.4:
version "2.29.4"
resolved "https://registry.yarnpkg.com/moment/-/moment-2.29.4.tgz#3dbe052889fe7c1b2ed966fcb3a77328964ef108"
integrity sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==

moo@^0.5.0, moo@^0.5.1:
version "0.5.2"
Expand Down