Version 0.48.2

Added a check that stops a release going out with a third-party package that carries a published security advisory.

NMTS runs on 901 packages written by other people — the Rust ones on the server and the JavaScript ones around the site — and whether any of them carried a security advisory that is already public was, until now, something nobody was looking at. Every deploy now asks a public advisory database about all 901, and stops if it finds one that has not been examined and written down. The first run found five; four were moved to newer versions in the same change, and the fifth is a package that never enters the build at all, so the reason and the date it was checked are recorded in the check itself. A vulnerability nobody has published yet does not appear, an advisory published between two deploys is not seen until the next one, and a name in the package list is not proof that the code runs.

Updated four third-party packages that carried published security advisories.

Three of the four are tools used only while building on our own machines; the fourth sits inside the server image. None of the four reaches your browser. No problem traceable to these advisories has been observed in NMTS, and the versions were moved anyway rather than left carrying a published advisory. The versions: event-listener 5.4.2, nanoid 3.3.18, js-yaml 4.3.1, brace-expansion 5.0.9.