[PR #320] [CLOSED] copilot-review: jgraph/drawio digest update (PR #315) #120

New issue

Closed

opened 2026-06-08 08:30:08 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:30:08 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/320
Author: @Copilot
Created: 5/30/2026
Status: ❌ Closed

Base: main ← Head: copilot/renovate-reviewer-agent-webgrip-homelab-cluster-31

📝 Commits (2)

ac17ecb Initial plan
5e68a70 copilot-review: PR #315

📊 Changes

1 file changed (+83 additions, -0 deletions)

View changed files

➕ .copilot-review/result.md (+83 -0)

📄 Description

Automated dependency review for PR #315 — jgraph/drawio container image digest bump (63ba7ec → 3fbc301, tag latest = v30.0.4).

Changes

.copilot-review/result.md — review artifact committed for relay workflow pickup; will be posted as a comment to PR #315 and then deleted automatically.

Key findings

Security (medium): GHSA-wj8x-4c77-v8v3 — DOM-based XSS via mXSS/MathML in crafted .drawio files, fixed in v29.7.12. Warrants prompt merge.
Major version boundary: v29.7.x → v30.0.4; changes are additive (new GCP3 stencils, multicolor stencil support, mermaid shapes, lockedGroup style). No confirmed breaking changes for self-hosted deployments.
DOMPurify: 3.3.3 → 3.4.5 across the release range — strengthens the sanitizer layer.
Verdict: Yellow Caution / Merge after checks — stateless workload, internal-only exposure, low rollback cost.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/320 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 5/30/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `copilot/renovate-reviewer-agent-webgrip-homelab-cluster-31` --- ### 📝 Commits (2) - [`ac17ecb`](https://github.com/webgrip/homelab-cluster/commit/ac17ecb9f8214ef3c0ed7cd8007eac6dd37cf0e4) Initial plan - [`5e68a70`](https://github.com/webgrip/homelab-cluster/commit/5e68a709b6770aa5038f8787744d8af8a98b4060) copilot-review: PR #315 ### 📊 Changes **1 file changed** (+83 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.copilot-review/result.md` (+83 -0) </details> ### 📄 Description Automated dependency review for PR #315 — `jgraph/drawio` container image digest bump (`63ba7ec` → `3fbc301`, tag `latest` = v30.0.4). ## Changes - **`.copilot-review/result.md`** — review artifact committed for relay workflow pickup; will be posted as a comment to PR #315 and then deleted automatically. ## Key findings - **Security (medium)**: GHSA-wj8x-4c77-v8v3 — DOM-based XSS via mXSS/MathML in crafted `.drawio` files, fixed in v29.7.12. Warrants prompt merge. - **Major version boundary**: v29.7.x → v30.0.4; changes are additive (new GCP3 stencils, multicolor stencil support, mermaid shapes, lockedGroup style). No confirmed breaking changes for self-hosted deployments. - **DOMPurify**: 3.3.3 → 3.4.5 across the release range — strengthens the sanitizer layer. - **Verdict**: Yellow Caution / Merge after checks — stateless workload, internal-only exposure, low rollback cost. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 08:30:08 +00:00

closed this issue
added the
pull-request
label

ryangr0 referenced this issue

2026-06-08 08:30:59 +00:00

[PR #120] [CLOSED] fix: grant write permissions for Copilot agent to post PR review comments #253

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster#120

No description provided.

Rows
Columns